CVE-2013-0664
The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.91%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to send Modbus messages, and consequently execute arbitrary code, by embedding these messages in SOAP HTTP POST requests.
- CVSS 2.0
- 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
- EPSS
- 3.91% probability · 90th percentile
- CISA KEV
- Not listed
- Affected
- schneider-electric/modicon quantum plc · schneider-electric/modicon m340 · schneider-electric/modicon premium
- Source
- ics-cert@hq.dhs.gov
References
- http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdfUS Government Resource
- http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/Vendor Advisory
- http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paperVendor Advisory
- http://ics-cert.us-cert.gov/pdf/ICSA-13-077-01A.pdfUS Government Resource
- http://www.schneider-electric.com/download/ww/en/details/35081317-Vulnerability-Disclosure-for-Quantum-Premium-and-M340/Vendor Advisory
- http://www.schneider-electric.com/download/ww/en/file/36555639-SEVD-2013-023-01.pdf/?fileName=SEVD-2013-023-01.pdf&reference=SEVD-2013-023-01&docType=Technical-paperVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.