CVE-2019-6821

CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet communication in Modicon M580 firmware versions prior to V2.30, and all firmware versions of Modicon M340, Modicon Premium, Modicon Quantum.

Score

CVSS 3.1 6.5 Medium

Status

Modified - cybersecurity@se.com

Published

2019-05-22

Last modified

2024-08-04

Weaknesses

CWE-330

Affected products

• Modicon M340 Firmware (Schneider-electric)
• Modicon M580 Firmware (Schneider-electric)
• Modicon Premium Firmware (Schneider-electric)
• Modicon Quantum Firmware (Schneider-electric)

References

• http://www.securityfocus.com/bid/108366
• https://ics-cert.us-cert.gov/advisories/ICSA-19-136-01
• https://www.schneider-electric.com/en/download/document/SEVD-2019-134-03/