Description
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
References (2)
Core 2
Core References
Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2019-316-02%20/
Not Applicable, Vendor Advisory x_refsource_confirm
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/
Scores
CVSS v3
7.5
EPSS
0.0138
EPSS Percentile
68.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-200
Status
published
Products (16)
Schneider Electric/Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
M340 communication modules
Schneider Electric/Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Modicon Controllers (M340 CPUs
Schneider Electric/Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Premium CPUs
Schneider Electric/Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Premium communication modules
Schneider Electric/Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Quantum CPUs
Schneider Electric/Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)
Quantum communication modules - see security notification for specific versions)
schneider-electric/140_cpu6x_firmware
schneider-electric/140_noc_77101_firmware
schneider-electric/140_noc_78x00_firmware
schneider-electric/140_noe_771x1_firmware
... and 6 more
Published
Nov 20, 2019
Tracked Since
Feb 18, 2026