Schneider Electric SE Vulnerabilities and Affected Products
Vulnerabilities associated with Modicon Premium, Modicon Quantum, Modicon M340, BMXNOR0200.
Products
Clear product- U.Motion20 vulnerabilities
- Pelco Sarix Professional12 vulnerabilities
- Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR02008 vulnerabilities
- 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS4 vulnerabilities
- Citect Anywhere4 vulnerabilities
- IIoT Monitor 3.1.384 vulnerabilities
- Modicon M221, all references, all versions prior to firmware V1.6.2.04 vulnerabilities
- Modicon M5804 vulnerabilities
- PowerSCADA Anywhere4 vulnerabilities
- U.motion Builder4 vulnerabilities
- Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0)3 vulnerabilities
- EVLink Parking v3.2.0-12_v1 and earlier3 vulnerabilities
- Modicon M3403 vulnerabilities
- Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions)3 vulnerabilities
- Modicon Quantum3 vulnerabilities
- Pelco Sarix Professional V13 vulnerabilities
- Pelco VideoXpert Enterprise3 vulnerabilities
- Ampla MES2 vulnerabilities
- BMXNOR0200H Ethernet / Serial RTU module2 vulnerabilities
- ClearSCADA2 vulnerabilities
- Modicon Premium2 vulnerabilities
- Modicon Premium, Modicon Quantum, Modicon M340, BMXNOR02002 vulnerabilities
- SoMachine HVAC Programming Software2 vulnerabilities
- U.motion Server2 vulnerabilities
- Wiser for KNX2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2018-7241CRITICAL | Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. CWE-798Apr 18, 2018 | CVSS9.8v3.0 | EPSS3.82% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2018-7242CRITICAL | Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules. The algorithm used to encrypt the password is vulnerable to hash collision attacks. CWE-326Apr 18, 2018 | CVSS9.8v3.0 | EPSS1.95% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |