CVE-2019-6855

Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.

Score

CVSS 3.1 7.3 High

Status

Modified - cybersecurity@se.com

Published

2020-01-06

Last modified

2024-08-04

Weaknesses

CWE-863

Affected products

• Ecostruxure Control Expert (Schneider-electric)
• Modicon M340 Bmxp341000 Firmware (Schneider-electric)
• Modicon M340 Bmxp342000 Firmware (Schneider-electric)
• Modicon M340 Bmxp3420102 Firmware (Schneider-electric)
• Modicon M340 Bmxp342020 Firmware (Schneider-electric)
• Modicon M340 Bmxp3420302 Firmware (Schneider-electric)
• Modicon M580 Bmeh582040 Firmware (Schneider-electric)
• Modicon M580 Bmeh584040 Firmware (Schneider-electric)
• Modicon M580 Bmeh584040s Firmware (Schneider-electric)
• Modicon M580 Bmeh586040 Firmware (Schneider-electric)
• Modicon M580 Bmeh586040s Firmware (Schneider-electric)
• Modicon M580 Bmep581020 Firmware (Schneider-electric)
• Modicon M580 Bmep582020 Firmware (Schneider-electric)
• Modicon M580 Bmep582040 Firmware (Schneider-electric)
• Modicon M580 Bmep582040s Firmware (Schneider-electric)
• Modicon M580 Bmep583020 Firmware (Schneider-electric)
• Modicon M580 Bmep583040 Firmware (Schneider-electric)
• Modicon M580 Bmep584020 Firmware (Schneider-electric)
• Modicon M580 Bmep584040 Firmware (Schneider-electric)
• Modicon M580 Bmep584040s Firmware (Schneider-electric)
• Modicon M580 Bmep585040 Firmware (Schneider-electric)
• Modicon M580 Bmep586040 Firmware (Schneider-electric)
• Unity Pro (Schneider-electric)

References

• https://www.se.com/ww/en/download/document/SEVD-2019-344-02/