Sign-up

ID

VAR-202001-1872


CVE

CVE-2019-6855


TITLE

EcoStruxure Control Expert and Unity Pro Vulnerable to unauthorized authentication

Trust: 0.8

sources: JVNDB: JVNDB-2019-014098

DESCRIPTION

Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers. Schneider Electric EcoStruxure Control Expert (formerly known as Unity Pro) and Unity Pro are products of the French company Schneider Electric. Schneider Electric EcoStruxure Control Expert is a set of programming software for Schneider Electric logic controller products. Unity Pro is a set of universal programming, debugging and operating software for the Modicon Premium, Atrium and Quantum PLC series. The vulnerability stems from a lack of authentication measures or insufficient authentication strength in a network system or product. No detailed vulnerability details are provided at this time

Trust: 2.25

sources: NVD: CVE-2019-6855 // JVNDB: JVNDB-2019-014098 // CNVD: CNVD-2020-03779 // VULHUB: VHN-158290

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2020-03779

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon m580 bmeh586040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:ecostruxure control expertscope:ltversion:14.1

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342020scope:ltversion:3.20

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep586040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh584040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep584040sscope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh586040sscope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582020scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:unity proscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp3420302scope:ltversion:3.20

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp3420102scope:ltversion:3.20

Trust: 1.0

vendor:schneider electricmodel:ecostruxure control expertscope:eqversion:14.1

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep585040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep584020scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh584040sscope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp341000scope:ltversion:3.20

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep583020scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmeh582040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep582040sscope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmxp342000scope:ltversion:3.20

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep581020scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep584040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:modicon m580 bmep583040scope:ltversion:3.10

Trust: 1.0

vendor:schneider electricmodel:ecostruxure control expertscope:eqversion:14.0

Trust: 0.8

vendor:schneider electricmodel:unity proscope: - version: -

Trust: 0.8

vendor:schneidermodel:electric unity proscope: - version: -

Trust: 0.6

vendor:schneidermodel:electric ecostruxure control expertscope:eqversion:14.0

Trust: 0.6

sources: CNVD: CNVD-2020-03779 // JVNDB: JVNDB-2019-014098 // NVD: CVE-2019-6855

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-6855
value: HIGH

Trust: 1.0

NVD: CVE-2019-6855
value: HIGH

Trust: 0.8

CNVD: CNVD-2020-03779
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202001-140
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201912-831
value: HIGH

Trust: 0.6

VULHUB: VHN-158290
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-6855
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2020-03779
severity: MEDIUM
baseScore: 6.4
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-158290
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-6855
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 3.4
version: 3.1

Trust: 1.0

NVD: CVE-2019-6855
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2020-03779 // VULHUB: VHN-158290 // JVNDB: JVNDB-2019-014098 // CNNVD: CNNVD-202001-140 // CNNVD: CNNVD-201912-831 // NVD: CVE-2019-6855

PROBLEMTYPE DATA

problemtype:CWE-863

Trust: 1.9

sources: VULHUB: VHN-158290 // JVNDB: JVNDB-2019-014098 // NVD: CVE-2019-6855

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-202001-140 // CNNVD: CNNVD-201912-831

TYPE

other

Trust: 1.2

sources: CNNVD: CNNVD-202001-140 // CNNVD: CNNVD-201912-831

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-014098

PATCH
title:SEVD-2019-344-02url:https://www.se.com/ww/en/download/document/SEVD-2019-344-02
Trust: 0.8
title:Patch for Schneider Electric EcoStruxure Control Expert and Unity Pro Licensing Issue Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/199155
Trust: 0.6
title:Schneider Electric EcoStruxure Control Expert  and Unity Pro Remediation measures for authorization problem vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=108294
Trust: 0.6
title:Schneider Electric EcoStruxure Control Expert Remediation measures for authorization problem vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=105932
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-03779 // 
            
            
            
            JVNDB: JVNDB-2019-014098 // 
            
            
            
            CNNVD: CNNVD-202001-140 // 
            
            
            
            CNNVD: CNNVD-201912-831

EXTERNAL IDS
db:NVDid:CVE-2019-6855
Trust: 3.7
db:SCHNEIDERid:SEVD-2019-344-02
Trust: 2.3
db:JVNDBid:JVNDB-2019-014098
Trust: 0.8
db:CNNVDid:CNNVD-201912-831
Trust: 0.7
db:CNNVDid:CNNVD-202001-140
Trust: 0.7
db:CNVDid:CNVD-2020-03779
Trust: 0.6
db:VULHUBid:VHN-158290
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2020-03779 // 
            
            
            
            VULHUB: VHN-158290 // 
            
            
            
            JVNDB: JVNDB-2019-014098 // 
            
            
            
            CNNVD: CNNVD-202001-140 // 
            
            
            
            CNNVD: CNNVD-201912-831 // 
            
            
            
            NVD: CVE-2019-6855

REFERENCES
url:https://nvd.nist.gov/vuln/detail/cve-2019-6855
Trust: 2.6
url:https://www.se.com/ww/en/download/document/sevd-2019-344-02/
Trust: 2.3
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6855
Trust: 0.8
url:https://www.se.com/ww/en/download/document/sevd-2019-344-02
Trust: 0.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-18181
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2020-03779 // 
            
            
            
            VULHUB: VHN-158290 // 
            
            
            
            JVNDB: JVNDB-2019-014098 // 
            
            
            
            CNNVD: CNNVD-202001-140 // 
            
            
            
            CNNVD: CNNVD-201912-831 // 
            
            
            
            NVD: CVE-2019-6855

CREDITS
Rongkuan Ma, Xin Che and Peng Cheng (Zhejiang University)
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-202001-140

SOURCES
db:CNVDid:CNVD-2020-03779
db:VULHUBid:VHN-158290
db:JVNDBid:JVNDB-2019-014098
db:CNNVDid:CNNVD-202001-140
db:CNNVDid:CNNVD-201912-831
db:NVDid:CVE-2019-6855

LAST UPDATE DATE
2024-08-14T14:38:34.574000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2020-03779date:2020-02-05T00:00:00
db:VULHUBid:VHN-158290date:2021-12-10T00:00:00
db:JVNDBid:JVNDB-2019-014098date:2020-01-31T00:00:00
db:CNNVDid:CNNVD-202001-140date:2022-11-15T00:00:00
db:CNNVDid:CNNVD-201912-831date:2022-03-10T00:00:00
db:NVDid:CVE-2019-6855date:2022-01-31T19:33:27.613

SOURCES RELEASE DATE
db:CNVDid:CNVD-2020-03779date:2020-02-05T00:00:00
db:VULHUBid:VHN-158290date:2020-01-06T00:00:00
db:JVNDBid:JVNDB-2019-014098date:2020-01-31T00:00:00
db:CNNVDid:CNNVD-202001-140date:2020-01-06T00:00:00
db:CNNVDid:CNNVD-201912-831date:2019-12-10T00:00:00
db:NVDid:CVE-2019-6855date:2020-01-06T23:15:11.237