Sign-up

ID

VAR-201905-0036


CVE

CVE-2019-6820


TITLE

plural Schneider Electric Vulnerability related to lack of certification for critical functions in the product

Trust: 0.8

sources: JVNDB: JVNDB-2019-004816

DESCRIPTION

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2. plural Schneider Electric The product is vulnerable to a lack of authentication for critical functions.Tampering with information and disrupting service operations (DoS) There is a possibility of being put into a state. Schneider Electric Modicon M100 and others are products of Schneider Electric, France. The Schneider Electric Modicon M100 is a programmable logic controller. The Schneider Electric Modicon LMC078 is a motion controller. The Schneider Electric ATV IMC drive controller is a drive controller. An access control error vulnerability exists in several Schneider Electric products. The following products and versions are affected: Schneider Electric Modicon M100 (all versions); Modicon M200 (all versions); Modicon M221 (all versions); ATV IMC drive controller (all versions); Modicon M241 (all versions); Modicon M258 (all versions); Modicon LMC058 (all versions); Modicon LMC078 (all versions); PacDrive Eco (all versions); PacDrive Pro (all versions); PacDrive Pro2 (all versions)

Trust: 2.52

sources: NVD: CVE-2019-6820 // JVNDB: JVNDB-2019-004816 // CNVD: CNVD-2019-15887 // IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3 // VULHUB: VHN-158255 // VULMON: CVE-2019-6820

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3 // CNVD: CNVD-2019-15887

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon m100scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:pacdrive ecoscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m258scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon lmc058scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m251scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m221scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:pacdrive pro2scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m241scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon lmc078scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m200scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:pacdrive proscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:atv imc drive controllerscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:atv imc drive controllerscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon lmc058scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon lmc078scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon m100scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon m200scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon m221scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon m241scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon m251scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon m258scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:pacdrive ecoscope: - version: -

Trust: 0.8

vendor:schneidermodel:electric modicon m258scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon lmc058scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon lmc078scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric pacdrive ecoscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric pacdrive proscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric pacdrive pro2scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon m200scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon m221scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric atv imc drive controllerscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon m241scope: - version: -

Trust: 0.6

vendor:schneidermodel:electric modicon m251scope: - version: -

Trust: 0.6

vendor:modicon m100model: - scope:eqversion:*

Trust: 0.2

vendor:pacdrive ecomodel: - scope:eqversion:*

Trust: 0.2

vendor:pacdrive promodel: - scope:eqversion:*

Trust: 0.2

vendor:pacdrive pro2model: - scope:eqversion:*

Trust: 0.2

vendor:modicon m200model: - scope:eqversion:*

Trust: 0.2

vendor:modicon m221model: - scope:eqversion:*

Trust: 0.2

vendor:atv imc drive controllermodel: - scope:eqversion:*

Trust: 0.2

vendor:modicon m241model: - scope:eqversion:*

Trust: 0.2

vendor:modicon m251model: - scope:eqversion:*

Trust: 0.2

vendor:modicon m258model: - scope:eqversion:*

Trust: 0.2

vendor:modicon lmc058model: - scope:eqversion:*

Trust: 0.2

vendor:modicon lmc078model: - scope:eqversion:*

Trust: 0.2

sources: IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3 // CNVD: CNVD-2019-15887 // JVNDB: JVNDB-2019-004816 // NVD: CVE-2019-6820

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6820
value: HIGH

Trust: 1.0

NVD: CVE-2019-6820
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-15887
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201905-932
value: HIGH

Trust: 0.6

IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3
value: HIGH

Trust: 0.2

VULHUB: VHN-158255
value: MEDIUM

Trust: 0.1

VULMON: CVE-2019-6820
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2019-6820
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2019-15887
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

VULHUB: VHN-158255
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-6820
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 4.2
version: 3.1

Trust: 1.0

NVD: CVE-2019-6820
baseSeverity: HIGH
baseScore: 8.2
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3 // CNVD: CNVD-2019-15887 // VULHUB: VHN-158255 // VULMON: CVE-2019-6820 // JVNDB: JVNDB-2019-004816 // CNNVD: CNNVD-201905-932 // NVD: CVE-2019-6820

PROBLEMTYPE DATA

problemtype:CWE-306

Trust: 1.9

sources: VULHUB: VHN-158255 // JVNDB: JVNDB-2019-004816 // NVD: CVE-2019-6820

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-932

TYPE

Access control error

Trust: 0.8

sources: IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3 // CNNVD: CNNVD-201905-932

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-004816

PATCH
title:SEVD-2019-134-02url:https://www.schneider-electric.com/en/download/document/SEVD-2019-134-02/
Trust: 0.8
title:CVE-2019-6820url:https://github.com/AlAIAL90/CVE-2019-6820 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-6820 // 
            
            
            
            JVNDB: JVNDB-2019-004816

EXTERNAL IDS
db:NVDid:CVE-2019-6820
Trust: 3.4
db:SCHNEIDERid:SEVD-2019-134-02
Trust: 1.8
db:CNNVDid:CNNVD-201905-932
Trust: 0.9
db:CNVDid:CNVD-2019-15887
Trust: 0.8
db:JVNDBid:JVNDB-2019-004816
Trust: 0.8
db:IVDid:275E0D38-40D0-4C09-B739-BA01427AB4F3
Trust: 0.2
db:VULHUBid:VHN-158255
Trust: 0.1
db:VULMONid:CVE-2019-6820
Trust: 0.1
sources:
            
            
            IVD: 275e0d38-40d0-4c09-b739-ba01427ab4f3 // 
            
            
            
            CNVD: CNVD-2019-15887 // 
            
            
            
            VULHUB: VHN-158255 // 
            
            
            
            VULMON: CVE-2019-6820 // 
            
            
            
            JVNDB: JVNDB-2019-004816 // 
            
            
            
            CNNVD: CNNVD-201905-932 // 
            
            
            
            NVD: CVE-2019-6820

REFERENCES
url:https://www.schneider-electric.com/en/download/document/sevd-2019-134-02/
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-6820
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6820
Trust: 0.8
url:https://web.nvd.nist.gov//vuln/detail/cve-2019-6820
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/306.html
Trust: 0.1
url:https://github.com/alaial90/cve-2019-6820
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-15887 // 
            
            
            
            VULHUB: VHN-158255 // 
            
            
            
            VULMON: CVE-2019-6820 // 
            
            
            
            JVNDB: JVNDB-2019-004816 // 
            
            
            
            CNNVD: CNNVD-201905-932 // 
            
            
            
            NVD: CVE-2019-6820

SOURCES
db:IVDid:275e0d38-40d0-4c09-b739-ba01427ab4f3
db:CNVDid:CNVD-2019-15887
db:VULHUBid:VHN-158255
db:VULMONid:CVE-2019-6820
db:JVNDBid:JVNDB-2019-004816
db:CNNVDid:CNNVD-201905-932
db:NVDid:CVE-2019-6820

LAST UPDATE DATE
2024-11-23T23:11:53.057000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-15887date:2019-05-30T00:00:00
db:VULHUBid:VHN-158255date:2019-10-09T00:00:00
db:VULMONid:CVE-2019-6820date:2021-08-26T00:00:00
db:JVNDBid:JVNDB-2019-004816date:2019-06-10T00:00:00
db:CNNVDid:CNNVD-201905-932date:2022-03-10T00:00:00
db:NVDid:CVE-2019-6820date:2024-11-21T04:47:13.107

SOURCES RELEASE DATE
db:IVDid:275e0d38-40d0-4c09-b739-ba01427ab4f3date:2019-05-30T00:00:00
db:CNVDid:CNVD-2019-15887date:2019-05-30T00:00:00
db:VULHUBid:VHN-158255date:2019-05-22T00:00:00
db:VULMONid:CVE-2019-6820date:2019-05-22T00:00:00
db:JVNDBid:JVNDB-2019-004816date:2019-06-10T00:00:00
db:CNNVDid:CNNVD-201905-932date:2019-05-22T00:00:00
db:NVDid:CVE-2019-6820date:2019-05-22T20:29:02.137