CVE-2019-6806

EUVD-2019-16360
A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Affected Products (NVD)
VendorProductVersion
schneider-electricmodicon_premium_firmware
-
schneider-electricmodicon_quantum_firmware
-
schneider-electricmodicon_m340_firmware
𝑥
< 3.10
schneider-electricmodicon_m580_firmware
𝑥
< 2.90
𝑥
= Vulnerable software versions
References
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0769
https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0769