CVE-2019-6820
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of:…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.25%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2
- CVSS 3.1
- 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- EPSS
- 1.25% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-306
- Affected
- schneider-electric/modicon m100 firmware · schneider-electric/modicon m200 firmware · schneider-electric/modicon m221 firmware · schneider-electric/atv imc drive controller firmware · schneider-electric/modicon m241 firmware · schneider-electric/modicon m251 firmware · schneider-electric/modicon m258 firmware · schneider-electric/modicon lmc058 firmware · schneider-electric/modicon lmc078 firmware · schneider-electric/pacdrive eco firmware · schneider-electric/pacdrive pro firmware · schneider-electric/pacdrive pro2 firmware
- Source
- cybersecurity@se.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.