Details of VAR-201905-0042

ID

VAR-201905-0042

CVE

CVE-2019-6806

TITLE

plural Modicon Information disclosure vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-004753

DESCRIPTION

A CWE-200: Information Exposure vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause the disclosure of SNMP information when reading variables in the controller using Modbus. plural Modicon The product contains an information disclosure vulnerability.Information may be obtained. Schneider Electric Modicon M580 and others are products of Schneider Electric, France. The Schneider Electric Modicon M580 is a programmable automation controller. Schneider Electric Modicon Premium is a large programmable logic controller (PLC) for discrete or process applications. Schneider Electric Modicon Quantum is a large programmable logic controller (PLC) for process applications, high availability and safety solutions. This vulnerability stems from configuration errors in network systems or products during operation. The following products and versions are affected: Schneider Electric Modicon M580 (all versions); Modicon M340 (all versions); Modicon Quantum (all versions); Modicon Premium (all versions)

Trust: 2.43

sources: NVD: CVE-2019-6806 // JVNDB: JVNDB-2019-004753 // CNVD: CNVD-2019-15331 // IVD: 262ff5a7-e7f0-4962-8aee-f3602ad478ed // VULHUB: VHN-158241

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 262ff5a7-e7f0-4962-8aee-f3602ad478ed // CNVD: CNVD-2019-15331

AFFECTED PRODUCTS

vendor:	schneider electric	model:	modicon quantum	scope:	eq	version:	-	Trust: 1.0
vendor:	schneider electric	model:	modicon premium	scope:	eq	version:	-	Trust: 1.0
vendor:	schneider electric	model:	modicon m340	scope:	lt	version:	3.10	Trust: 1.0
vendor:	schneider electric	model:	modicon m580	scope:	lt	version:	2.90	Trust: 1.0
vendor:	schneider electric	model:	modicon m340	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	modicon m580	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	modicon premium plc	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	modicon quantum plc	scope:	-	version:	-	Trust: 0.8
vendor:	schneider	model:	electric modicon m340	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric modicon premium	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric modicon quantum	scope:	-	version:	-	Trust: 0.6
vendor:	schneider	model:	electric modicon m580	scope:	-	version:	-	Trust: 0.6
vendor:	modicon premium	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	modicon quantum	model:	-	scope:	eq	version:	-	Trust: 0.2
vendor:	modicon m340	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	modicon m580	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 262ff5a7-e7f0-4962-8aee-f3602ad478ed // CNVD: CNVD-2019-15331 // JVNDB: JVNDB-2019-004753 // NVD: CVE-2019-6806

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-6806
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-6806
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2019-15331
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201905-943
value:	HIGH
Trust: 0.6
IVD:	262ff5a7-e7f0-4962-8aee-f3602ad478ed
value:	HIGH
Trust: 0.2
VULHUB:	VHN-158241
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-6806
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2019-15331
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	262ff5a7-e7f0-4962-8aee-f3602ad478ed
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-158241
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-6806
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0
NVD:	CVE-2019-6806
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: IVD: 262ff5a7-e7f0-4962-8aee-f3602ad478ed // CNVD: CNVD-2019-15331 // VULHUB: VHN-158241 // JVNDB: JVNDB-2019-004753 // CNNVD: CNNVD-201905-943 // NVD: CVE-2019-6806

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-200	Trust: 0.9

sources: VULHUB: VHN-158241 // JVNDB: JVNDB-2019-004753 // NVD: CVE-2019-6806

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-943

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201905-943

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-004753

PATCH

title:

SEVD-2019-134-11

url:

https://www.schneider-electric.com/en/download/document/SEVD-2019-134-11/

Trust: 0.8

sources: JVNDB: JVNDB-2019-004753

EXTERNAL IDS

db:	NVD	id:	CVE-2019-6806	Trust: 3.3
db:	SCHNEIDER	id:	SEVD-2019-134-11	Trust: 2.3
db:	TALOS	id:	TALOS-2019-0769	Trust: 1.7
db:	CNNVD	id:	CNNVD-201905-943	Trust: 0.9
db:	CNVD	id:	CNVD-2019-15331	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-004753	Trust: 0.8
db:	IVD	id:	262FF5A7-E7F0-4962-8AEE-F3602AD478ED	Trust: 0.2
db:	VULHUB	id:	VHN-158241	Trust: 0.1

sources: IVD: 262ff5a7-e7f0-4962-8aee-f3602ad478ed // CNVD: CNVD-2019-15331 // VULHUB: VHN-158241 // JVNDB: JVNDB-2019-004753 // CNNVD: CNNVD-201905-943 // NVD: CVE-2019-6806

REFERENCES

url:	https://www.schneider-electric.com/en/download/document/sevd-2019-134-11/	Trust: 2.3
url:	https://www.talosintelligence.com/vulnerability_reports/talos-2019-0769	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-6806	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6806	Trust: 0.8
url:	https://web.nvd.nist.gov//vuln/detail/cve-2019-6806	Trust: 0.6
url:	https://talosintelligence.com/vulnerability_reports/talos-2019-0769	Trust: 0.6

sources: CNVD: CNVD-2019-15331 // VULHUB: VHN-158241 // JVNDB: JVNDB-2019-004753 // CNNVD: CNNVD-201905-943 // NVD: CVE-2019-6806

CREDITS

Discovered by Jared Rittle of Cisco Talos.

Trust: 0.6

sources: CNNVD: CNNVD-201905-943

SOURCES

db:	IVD	id:	262ff5a7-e7f0-4962-8aee-f3602ad478ed
db:	CNVD	id:	CNVD-2019-15331
db:	VULHUB	id:	VHN-158241
db:	JVNDB	id:	JVNDB-2019-004753
db:	CNNVD	id:	CNNVD-201905-943
db:	NVD	id:	CVE-2019-6806

LAST UPDATE DATE

2024-11-23T21:52:12.462000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-15331	date:	2019-05-24T00:00:00
db:	VULHUB	id:	VHN-158241	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-004753	date:	2019-06-07T00:00:00
db:	CNNVD	id:	CNNVD-201905-943	date:	2022-03-10T00:00:00
db:	NVD	id:	CVE-2019-6806	date:	2024-11-21T04:47:11.773

SOURCES RELEASE DATE

db:	IVD	id:	262ff5a7-e7f0-4962-8aee-f3602ad478ed	date:	2019-05-24T00:00:00
db:	CNVD	id:	CNVD-2019-15331	date:	2019-05-24T00:00:00
db:	VULHUB	id:	VHN-158241	date:	2019-05-22T00:00:00
db:	JVNDB	id:	JVNDB-2019-004753	date:	2019-06-07T00:00:00
db:	CNNVD	id:	CNNVD-201905-943	date:	2019-05-22T00:00:00
db:	NVD	id:	CVE-2019-6806	date:	2019-05-22T21:29:00.603