VulnerabilityModified
CVE-2018-7241
Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules.
CRITICAL 9.8EPSS 3.77%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.77%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.77% probability · 89th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-798
- Affected
- schneider-electric/bmxnor0200 firmware · schneider-electric/bmxnor0200h firmware · schneider-electric/140cpu65150 firmware · schneider-electric/140cpu31110 firmware · schneider-electric/140cpu43412u firmware · schneider-electric/140cpu65160 firmware · schneider-electric/140cpu65260 firmware · schneider-electric/140cpu65860 firmware · schneider-electric/140cpu65160s firmware · schneider-electric/140cpu65150c firmware · schneider-electric/140cpu31110c firmware · schneider-electric/140cpu43412uc firmware · schneider-electric/140cpu65160c firmware · schneider-electric/140cpu65260c firmware · schneider-electric/140cpu65860c firmware · schneider-electric/modicon m340 bmxp341000 firmware · schneider-electric/modicon m340 bmxp342000 firmware · schneider-electric/modicon m340 bmxp3420102 firmware · schneider-electric/modicon m340 bmxp3420102cl firmware · schneider-electric/modicon m340 bmxp342020 firmware · +37 more
- Source
- cybersecurity@se.com
References
- http://www.securityfocus.com/bid/103542Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-086-01Third Party Advisory, US Government Resource
- https://www.schneider-electric.com/en/download/document/SEVD-2018-081-01/Vendor Advisory
- http://www.securityfocus.com/bid/103542Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-086-01Third Party Advisory, US Government Resource
- https://www.schneider-electric.com/en/download/document/SEVD-2018-081-01/Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.