Sign-up

ID

VAR-201910-0583


CVE

CVE-2019-6850


TITLE

plural Modicon Information disclosure vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-011423

DESCRIPTION

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when reading specific registers with the REST API of the controller/communication module. Modicon M580 , Modicon BMENOC 0311 , Modicon BMENOC 0321 Contains an information disclosure vulnerability.Information may be obtained. Modicon M580 / BMENOC 0311 / BMENOC 0321 are all programmable logic controllers from Schneider Electric

Trust: 2.34

sources: NVD: CVE-2019-6850 // JVNDB: JVNDB-2019-011423 // CNVD: CNVD-2019-44957 // IVD: 048ec798-36a9-42af-963a-821950cd5c84

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 048ec798-36a9-42af-963a-821950cd5c84 // CNVD: CNVD-2019-44957

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon bmenoc 0311scope:eqversion: -

Trust: 2.2

vendor:schneider electricmodel:modicon m580scope:eqversion: -

Trust: 2.2

vendor:schneider electricmodel:modicon bmenoc 0321scope:eqversion: -

Trust: 2.2

vendor:schneider electricmodel:modicon bmenoc 0311scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon bmenoc 0321scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon m580scope: - version: -

Trust: 0.8

vendor:schneidermodel:electric modicon m580scope: - version: -

Trust: 0.6

vendor:modicon m580model: - scope:eqversion: -

Trust: 0.2

vendor:modicon bmenoc 0311model: - scope:eqversion: -

Trust: 0.2

vendor:modicon bmenoc 0321model: - scope:eqversion: -

Trust: 0.2

sources: IVD: 048ec798-36a9-42af-963a-821950cd5c84 // CNVD: CNVD-2019-44957 // JVNDB: JVNDB-2019-011423 // CNNVD: CNNVD-201910-409 // NVD: CVE-2019-6850

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6850
value: HIGH

Trust: 1.0

NVD: CVE-2019-6850
value: HIGH

Trust: 0.8

CNVD: CNVD-2019-44957
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201910-409
value: HIGH

Trust: 0.6

IVD: 048ec798-36a9-42af-963a-821950cd5c84
value: HIGH

Trust: 0.2

nvd@nist.gov: CVE-2019-6850
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2019-44957
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 048ec798-36a9-42af-963a-821950cd5c84
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

nvd@nist.gov: CVE-2019-6850
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: CVE-2019-6850
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: IVD: 048ec798-36a9-42af-963a-821950cd5c84 // CNVD: CNVD-2019-44957 // JVNDB: JVNDB-2019-011423 // CNNVD: CNNVD-201910-409 // NVD: CVE-2019-6850

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2019-011423 // NVD: CVE-2019-6850

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201910-409

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201910-409

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-011423

PATCH
title:SEVD-2019-281-04url:https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04
Trust: 0.8
title:Patch for Schneider Electric Modicon M580 / BMENOC 0311 / BMENOC 0321 Information Disclosure Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/193529
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-44957 // 
            
            
            
            JVNDB: JVNDB-2019-011423

EXTERNAL IDS
db:NVDid:CVE-2019-6850
Trust: 3.2
db:SCHNEIDERid:SEVD-2019-281-04
Trust: 1.6
db:CNVDid:CNVD-2019-44957
Trust: 0.8
db:CNNVDid:CNNVD-201910-409
Trust: 0.8
db:JVNDBid:JVNDB-2019-011423
Trust: 0.8
db:TALOSid:TALOS-2019-0868
Trust: 0.6
db:IVDid:048EC798-36A9-42AF-963A-821950CD5C84
Trust: 0.2
sources:
            
            
            IVD: 048ec798-36a9-42af-963a-821950cd5c84 // 
            
            
            
            CNVD: CNVD-2019-44957 // 
            
            
            
            JVNDB: JVNDB-2019-011423 // 
            
            
            
            CNNVD: CNNVD-201910-409 // 
            
            
            
            NVD: CVE-2019-6850

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2019-6850
Trust: 2.0
url:https://www.schneider-electric.com/ww/en/download/document/sevd-2019-281-04
Trust: 1.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6850
Trust: 0.8
url:https://www.talosintelligence.com/vulnerability_reports/talos-2019-0868
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2019-44957 // 
            
            
            
            JVNDB: JVNDB-2019-011423 // 
            
            
            
            CNNVD: CNNVD-201910-409 // 
            
            
            
            NVD: CVE-2019-6850

CREDITS
Discovered by Jared Rittle of Cisco Talos.
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201910-409

SOURCES
db:IVDid:048ec798-36a9-42af-963a-821950cd5c84
db:CNVDid:CNVD-2019-44957
db:JVNDBid:JVNDB-2019-011423
db:CNNVDid:CNNVD-201910-409
db:NVDid:CVE-2019-6850

LAST UPDATE DATE
2024-11-23T22:21:25.712000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-44957date:2019-12-11T00:00:00
db:JVNDBid:JVNDB-2019-011423date:2019-11-07T00:00:00
db:CNNVDid:CNNVD-201910-409date:2019-11-22T00:00:00
db:NVDid:CVE-2019-6850date:2024-11-21T04:47:16.667

SOURCES RELEASE DATE
db:IVDid:048ec798-36a9-42af-963a-821950cd5c84date:2019-12-11T00:00:00
db:CNVDid:CNVD-2019-44957date:2019-12-10T00:00:00
db:JVNDBid:JVNDB-2019-011423date:2019-11-07T00:00:00
db:CNNVDid:CNNVD-201910-409date:2019-10-08T00:00:00
db:NVDid:CVE-2019-6850date:2019-10-29T19:15:22.487