CVE-2019-6839

HIGH

Schneider Electric U.motion Server - Unrestricted File Upload

Title source: manual
STIX 2.1

Description

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, MEG6260-0415 - U.motion KNX Server Plus, Touch 15), which could allow a user with low privileges to upload a rogue file.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0049
EPSS Percentile 65.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (4)
schneider-electric/meg6260-0410_firmware < 1.3.7
schneider-electric/meg6260-0415_firmware < 1.3.7
schneider-electric/meg6501-0001_firmware < 1.3.7
schneider-electric/meg6501-0002_firmware < 1.3.7
Published Sep 17, 2019
Tracked Since Feb 18, 2026