Sign-up

ID

VAR-201903-0642


CVE

CVE-2015-6461


TITLE

Schneider Electric Modicon PLC File contains vulnerabilities

Trust: 0.8

sources: IVD: 7c567132-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05940

DESCRIPTION

Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page. plural Schneider Electric Modicon The product contains an input validation vulnerability.Information may be obtained and information may be altered. Modicon PLC is a programmable controller product for the dam, energy, food agriculture and other industries. Schneider Electric Modicon M340 PLC is a medium-sized PLC platform for industrial processes and architectures. There are several security holes in the Modicon M340 PLC Station P34 module. Exploitation of these vulnerabilities could allow remote attackers to obtain sensitive information or execute arbitrary code on a web server, bypass authentication mechanisms, and access vulnerable devices

Trust: 3.42

sources: NVD: CVE-2015-6461 // JVNDB: JVNDB-2015-008242 // CNVD: CNVD-2015-05940 // CNVD: CNVD-2015-05740 // BID: 76327 // IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d // IVD: 7c567132-2351-11e6-abef-000c29c66e3d // VULHUB: VHN-84422

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.6

sources: IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d // IVD: 7c567132-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05940 // CNVD: CNVD-2015-05740

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon m340 bmxp3420302hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342030hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0100scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0110scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoc0401scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoe0110hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnor0200hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp3420302scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342030scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342020hscope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342020scope:eqversion: -

Trust: 1.0

vendor:schneider electricmodel:bmxnoc0401scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0100scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0110scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnoe0110hscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxnor0200hscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp342020scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp342020hscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp342030scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp3420302scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:bmxp3420302hscope: - version: -

Trust: 0.8

vendor:schneidermodel:electric modicon plcscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon m340 plc station p34 modulescope: - version: -

Trust: 0.6

vendor:bmxnoc0401model: - scope:eqversion: -

Trust: 0.4

vendor:bmxp3420302hmodel: - scope:eqversion: -

Trust: 0.4

vendor:bmxp342030hmodel: - scope:eqversion: -

Trust: 0.4

vendor:bmxnoe0100model: - scope:eqversion: -

Trust: 0.4

vendor:bmxnoe0110model: - scope:eqversion: -

Trust: 0.4

vendor:bmxnoe0110hmodel: - scope:eqversion: -

Trust: 0.4

vendor:bmxnor0200hmodel: - scope:eqversion: -

Trust: 0.4

vendor:bmxp342020model: - scope:eqversion: -

Trust: 0.4

vendor:bmxp342020hmodel: - scope:eqversion: -

Trust: 0.4

vendor:bmxp342030model: - scope:eqversion: -

Trust: 0.4

vendor:bmxp3420302model: - scope:eqversion: -

Trust: 0.4

sources: IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d // IVD: 7c567132-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05940 // CNVD: CNVD-2015-05740 // JVNDB: JVNDB-2015-008242 // NVD: CVE-2015-6461

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-6461
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-6461
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-05940
value: LOW

Trust: 0.6

CNVD: CNVD-2015-05740
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201508-386
value: MEDIUM

Trust: 0.6

IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: 7c567132-2351-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

VULHUB: VHN-84422
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-6461
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-05940
severity: LOW
baseScore: 3.2
vectorString: AV:L/AC:L/AU:S/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.1
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2015-05740
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

IVD: 7c567132-2351-11e6-abef-000c29c66e3d
severity: LOW
baseScore: 3.2
vectorString: AV:L/AC:L/AU:S/C:P/I:P/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 3.1
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-84422
severity: MEDIUM
baseScore: 5.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-6461
baseSeverity: MEDIUM
baseScore: 5.4
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.5
version: 3.0

Trust: 1.8

sources: IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d // IVD: 7c567132-2351-11e6-abef-000c29c66e3d // CNVD: CNVD-2015-05940 // CNVD: CNVD-2015-05740 // VULHUB: VHN-84422 // JVNDB: JVNDB-2015-008242 // CNNVD: CNNVD-201508-386 // NVD: CVE-2015-6461

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

problemtype:CWE-98

Trust: 1.0

sources: VULHUB: VHN-84422 // JVNDB: JVNDB-2015-008242 // NVD: CVE-2015-6461

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201508-386

TYPE

Input validation error

Trust: 1.3

sources: IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d // IVD: 7c567132-2351-11e6-abef-000c29c66e3d // BID: 76327 // CNNVD: CNNVD-201508-386

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-008242

PATCH
title:トップページurl:https://www.se.com/jp/ja/
Trust: 0.8
title:Schneider Electric Modicon PLC file contains patches for vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/63776
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-05940 // 
            
            
            
            JVNDB: JVNDB-2015-008242

EXTERNAL IDS
db:NVDid:CVE-2015-6461
Trust: 3.8
db:ICS CERTid:ICSA-15-246-02
Trust: 3.1
db:CNNVDid:CNNVD-201508-386
Trust: 1.1
db:BIDid:76327
Trust: 1.0
db:CNVDid:CNVD-2015-05740
Trust: 0.8
db:CNVDid:CNVD-2015-05940
Trust: 0.8
db:JVNDBid:JVNDB-2015-008242
Trust: 0.8
db:SCHNEIDERid:SEVD-2015-233-01
Trust: 0.6
db:IVDid:0ACA935A-1E69-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:IVDid:7C567132-2351-11E6-ABEF-000C29C66E3D
Trust: 0.2
db:VULHUBid:VHN-84422
Trust: 0.1
sources:
            
            
            IVD: 0aca935a-1e69-11e6-abef-000c29c66e3d // 
            
            
            
            IVD: 7c567132-2351-11e6-abef-000c29c66e3d // 
            
            
            
            CNVD: CNVD-2015-05940 // 
            
            
            
            CNVD: CNVD-2015-05740 // 
            
            
            
            VULHUB: VHN-84422 // 
            
            
            
            BID: 76327 // 
            
            
            
            JVNDB: JVNDB-2015-008242 // 
            
            
            
            CNNVD: CNNVD-201508-386 // 
            
            
            
            NVD: CVE-2015-6461

REFERENCES
url:https://ics-cert.us-cert.gov/advisories/icsa-15-246-02
Trust: 3.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-6461
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6461
Trust: 0.8
url:http://download.schneider-electric.com/files?p_file_id=1039693246&p_file_name=sevd-2015-233-01.pdf
Trust: 0.6
url:http://www.securityfocus.com/bid/76327
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-05940 // 
            
            
            
            CNVD: CNVD-2015-05740 // 
            
            
            
            VULHUB: VHN-84422 // 
            
            
            
            JVNDB: JVNDB-2015-008242 // 
            
            
            
            CNNVD: CNNVD-201508-386 // 
            
            
            
            NVD: CVE-2015-6461

CREDITS
Aditya K. Sood
Trust: 0.9
sources:
            
            
            BID: 76327 // 
            
            
            
            CNNVD: CNNVD-201508-386

SOURCES
db:IVDid:0aca935a-1e69-11e6-abef-000c29c66e3d
db:IVDid:7c567132-2351-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2015-05940
db:CNVDid:CNVD-2015-05740
db:VULHUBid:VHN-84422
db:BIDid:76327
db:JVNDBid:JVNDB-2015-008242
db:CNNVDid:CNNVD-201508-386
db:NVDid:CVE-2015-6461

LAST UPDATE DATE
2024-11-23T22:30:07.790000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2015-05940date:2015-09-11T00:00:00
db:CNVDid:CNVD-2015-05740date:2015-09-01T00:00:00
db:VULHUBid:VHN-84422date:2019-10-09T00:00:00
db:BIDid:76327date:2015-11-03T19:30:00
db:JVNDBid:JVNDB-2015-008242date:2019-05-07T00:00:00
db:CNNVDid:CNNVD-201508-386date:2019-10-10T00:00:00
db:NVDid:CVE-2015-6461date:2024-11-21T02:35:00.673

SOURCES RELEASE DATE
db:IVDid:0aca935a-1e69-11e6-abef-000c29c66e3ddate:2015-09-01T00:00:00
db:IVDid:7c567132-2351-11e6-abef-000c29c66e3ddate:2015-09-11T00:00:00
db:CNVDid:CNVD-2015-05940date:2015-09-11T00:00:00
db:CNVDid:CNVD-2015-05740date:2015-09-01T00:00:00
db:VULHUBid:VHN-84422date:2019-03-21T00:00:00
db:BIDid:76327date:2015-08-12T00:00:00
db:JVNDBid:JVNDB-2015-008242date:2019-05-07T00:00:00
db:CNNVDid:CNNVD-201508-386date:2015-08-18T00:00:00
db:NVDid:CVE-2015-6461date:2019-03-21T19:29:00.267