cnvd - cnvd-2019-44958

cnvd-2019-44958

Vulnerability from cnvd

Title: Schneider Electric Modicon M580/BMENOC 0311/BMENOC 0321信息泄露漏洞（CNVD-2019-44958）

Description:

Modicon M580/BMENOC 0311/BMENOC 0321均是Schneider Electric（施耐德电气）推出的可编程逻辑控制器。

Modicon M580/BMENOC 0311/BMENOC 0321存在信息泄露漏洞。攻击者可利用该漏洞在使用控制器/通信模块的REST API提供的特定Modbus服务时获取敏感信息。

Severity: 中

Patch Name: Schneider Electric Modicon M580/BMENOC 0311/BMENOC 0321信息泄露漏洞（CNVD-2019-44958）的补丁

Patch Description:

Modicon M580/BMENOC 0311/BMENOC 0321均是Schneider Electric（施耐德电气）推出的可编程逻辑控制器。

Modicon M580/BMENOC 0311/BMENOC 0321存在信息泄露漏洞。攻击者可利用该漏洞在使用控制器/通信模块的REST API提供的特定Modbus服务时获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-281-04_Modicon_Controllers.pdf&p_Doc_Ref=SEVD-2019-281-04

Reference: https://nvd.nist.gov/vuln/detail/CVE-2019-6849

Impacted products

Name
Schneider Electric Modicon M580

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-6849",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-6849"
    }
  },
  "description": "Modicon M580/BMENOC 0311/BMENOC 0321\u5747\u662fSchneider Electric\uff08\u65bd\u8010\u5fb7\u7535\u6c14\uff09\u63a8\u51fa\u7684\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\n\nModicon M580/BMENOC 0311/BMENOC 0321\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u4f7f\u7528\u63a7\u5236\u5668/\u901a\u4fe1\u6a21\u5757\u7684REST API\u63d0\u4f9b\u7684\u7279\u5b9aModbus\u670d\u52a1\u65f6\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://download.schneider-electric.com/files?p_enDocType=Technical+leaflet\u0026p_File_Name=SEVD-2019-281-04_Modicon_Controllers.pdf\u0026p_Doc_Ref=SEVD-2019-281-04",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-44958",
  "openTime": "2019-12-10",
  "patchDescription": "Modicon M580/BMENOC 0311/BMENOC 0321\u5747\u662fSchneider Electric\uff08\u65bd\u8010\u5fb7\u7535\u6c14\uff09\u63a8\u51fa\u7684\u53ef\u7f16\u7a0b\u903b\u8f91\u63a7\u5236\u5668\u3002\r\n\r\nModicon M580/BMENOC 0311/BMENOC 0321\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u4f7f\u7528\u63a7\u5236\u5668/\u901a\u4fe1\u6a21\u5757\u7684REST API\u63d0\u4f9b\u7684\u7279\u5b9aModbus\u670d\u52a1\u65f6\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Schneider Electric Modicon M580/BMENOC 0311/BMENOC 0321\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2019-44958\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Schneider Electric Modicon M580"
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2019-6849",
  "serverity": "\u4e2d",
  "submitTime": "2019-10-30",
  "title": "Schneider Electric Modicon M580/BMENOC 0311/BMENOC 0321\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff08CNVD-2019-44958\uff09"
}

CVE-2019-6849 (GCVE-0-2019-6849)

Vulnerability from cvelistv5

Published

2019-10-29 14:53

Modified

2024-08-04 20:31

Severity ?

CWE

CWE-200 - Information Exposure

Summary

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module.

References

▼	URL	Tags
	https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321	Version: Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T20:31:04.468Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Information Exposure",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-10-29T14:53:44",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cybersecurity@schneider-electric.com",
          "ID": "CVE-2019-6849",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Modicon M580, Modicon BMENOC 0311, Modicon BMENOC 0321"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-200: Information Exposure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04",
              "refsource": "CONFIRM",
              "url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2019-6849",
    "datePublished": "2019-10-29T14:53:44",
    "dateReserved": "2019-01-25T00:00:00",
    "dateUpdated": "2024-08-04T20:31:04.468Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted