Schneider Electric SE Vulnerabilities and Affected Products

Open in search

Explore source-attributed vulnerabilities associated with Schneider Electric SE products.

Products

Showing 25 vulnerabilities on this page

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service when reading data with invalid index using Modbus TCP.

CWE-754Jan 6, 2020
CVSS7.5v3.1EPSS1.4%PoCs0SignalsSTIX

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service of the controller when reading specific memory blocks using Modbus TCP.

CWE-754Jan 6, 2020
CVSS7.5v3.1EPSS1.63%PoCs0SignalsSTIX

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions) which could cause a Denial of Service when writing specific physical memory blocks using Modbus TCP.

CWE-754Jan 6, 2020
CVSS7.5v3.1EPSS1.63%PoCs0SignalsSTIX

A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon Premium (all versions), and Modicon Quantum (all versions), which could cause a possible denial of service when reading specific coils and registers in the controller over Modbus.

CWE-248CWE-755Sep 17, 2019
CVSS7.5v3.1EPSS1.53%PoCs0SignalsSTIX

A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execution on the system running SoMachine HVAC when a malicious DLL library is loaded by the product.

CWE-426Sep 17, 2019
CVSS7.8v3.1EPSS1.23%PoCs0SignalsSTIX

An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could cause denial of service when the module receives an IP fragmented packet with a length greater than 65535 bytes. The module then requires a power cycle to recover.

CWE-754Sep 17, 2019
CVSS7.5v3.1EPSS1.31%PoCs0SignalsSTIX

CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of commands by unauthorized users when using IEC 60870-5-104 protocol.

CWE-284Sep 17, 2019
CVSS8.8v3.1EPSS1.73%PoCs0SignalsSTIX

A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon Premium (all versions), Modicon Quantum (all versions), which could cause a possible denial of service when reading invalid data from the controller.

CWE-248CWE-755Sep 17, 2019
CVSS7.5v3.1EPSS1.76%PoCs0SignalsSTIX

A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to be viewed in plaintext when Remote Monitoring is enabled, and then disabled.

CWE-255CWE-522Sep 17, 2019
CVSS9.8v3.1EPSS1.03%PoCs0SignalsSTIX

A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prior to V3.10), which could cause a possible denial of service when writing to specific memory addresses in the controller over Modbus.

CWE-248CWE-755Sep 17, 2019
CVSS7.5v3.1EPSS1.61%PoCs0SignalsSTIX

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versions of - HMIGTO, HMISTO, XBTGH, HMIGTU, HMIGTUX, HMISCU, HMISTU, XBTGT, XBTGT, HMIGXO, HMIGXU), which could cause a temporary freeze of the HMI when a high rate of frames is received. When the attack stops, the buffered commands are processed by the HMI panel.

CWE-754Sep 17, 2019
CVSS6.5v3.1EPSS1.05%PoCs0SignalsSTIX

A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLYnk), which could cause loss of control when an attacker bypasses the authentication.

CWE-287Sep 17, 2019
CVSS8.3v3.1EPSS1.46%PoCs0SignalsSTIX

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause disconnection of active connections when an unusually high number of IEC 60870- 5-104 packets are received by the module on port 2404/TCP.

CWE-754Sep 17, 2019
CVSS8.6v3.1EPSS1.4%PoCs0SignalsSTIX

A CWE-248: Uncaught Exception vulnerability exists IN Modicon M580 all versions prior to V2.80, which could cause a possible denial of service when sending an appropriately timed HTTP request to the controller.

CWE-248CWE-755Sep 17, 2019
CVSS5.9v3.1EPSS1.1%PoCs0SignalsSTIX

A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an attacker to send a crafted message to the target server, thereby causing arbitrary commands to be executed.

CWE-134Sep 17, 2019
CVSS9.8v3.1EPSS1.15%PoCs0SignalsSTIX

A Cross-Site Scripting (XSS) CWE-79 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow an attacker to inject client-side script when a user visits a web page.

CWE-79Sep 17, 2019
CVSS5.4v3.1EPSS0.521%PoCs0SignalsSTIX

A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cause remote code to be executed when parsing a GD1 file

CWE-787Feb 6, 2019
CVSS7.8v3.0EPSS1.23%PoCs0SignalsSTIX

A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially crafted Zelio Soft project file.

CWE-416Feb 6, 2019
CVSS7.8v3.0EPSS3.04%PoCs0SignalsSTIX

A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could cause remote code to be executed when parsing a GD1 file

CWE-704Feb 6, 2019
CVSS7.8v3.0EPSS1.14%PoCs0SignalsSTIX

A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cause remote code to be executed when parsing a GD1 file

CWE-704Feb 6, 2019
CVSS7.8v3.0EPSS1.14%PoCs0SignalsSTIX

A Cryptographic Issue (CWE-310) vulnerability exists in IIoT Monitor 3.1.38 which could allow information disclosure.

CWE-310Feb 6, 2019
CVSS5.5v3.0EPSS0.325%PoCs0SignalsSTIX

A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device.

CWE-798Dec 24, 2018
CVSS9.8v3.0EPSS3.95%PoCs0SignalsSTIX

A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core Services 9.4 (CCS 9.4) and FoxView 10.5.) which could cause unauthorized disclosure, modification, or disruption in service when the password is modified without permission.

Dec 24, 2018
CVSS8.7v3.0EPSS0.322%PoCs0SignalsSTIX

A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges.

CWE-89Dec 24, 2018
CVSS8.8v3.0EPSS2.33%PoCs0SignalsSTIX

An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrary executable when GP-Pro EX is launched.

CWE-20Dec 24, 2018
CVSS8.8v3.0EPSS2.2%PoCs0SignalsSTIX