CVE-2019-6820

HIGH

Schneider Electric Modicon and PacDrive Firmware - Unauthenticated IP Configuration Modification via Ethernet Frame

Title source: llm
STIX 2.1

Description

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2

References (1)

Core 1
Core References

Scores

CVSS v3 8.2
EPSS 0.0124
EPSS Percentile 65.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-306
Status published
Products (13)
None/Modicon and PacDrive Controller, All versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Modicon and PacDrive Controller, All versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC
schneider-electric/atv_imc_drive_controller_firmware
schneider-electric/modicon_lmc058_firmware
schneider-electric/modicon_lmc078_firmware
schneider-electric/modicon_m100_firmware
schneider-electric/modicon_m200_firmware
schneider-electric/modicon_m221_firmware
schneider-electric/modicon_m241_firmware
schneider-electric/modicon_m251_firmware
schneider-electric/modicon_m258_firmware
... and 3 more
Published May 22, 2019
Tracked Since Feb 18, 2026