Schneider Electric SE vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2019-6857 A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see securiHigh 7.5 · Jan 6, 2020
• CVE-2019-6856 A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see securiHigh 7.5 · Jan 6, 2020
• CVE-2018-7794 A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see securiHigh 7.5 · Jan 6, 2020
• CVE-2019-6840 A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.Critical 9.8 · Sep 17, 2019
• CVE-2019-6832 A CWE-287: Authentication vulnerability exists in spaceLYnk (all versions before 2.4.0) and Wiser for KNX (all versions before 2.4.0 - formerly known as homeLYnHigh 8.3 · Sep 17, 2019
• CVE-2019-6831 A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which High 8.6 · Sep 17, 2019
• CVE-2019-6829 A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware version prior to V2.90) and Modicon M340 (firmware version prior to V3.10), which cHigh 7.5 · Sep 17, 2019
• CVE-2019-6828 A CWE-248: Uncaught Exception vulnerability exists Modicon M580 (firmware version prior to V2.90), Modicon M340 (firmware version prior to V3.10), Modicon PremiHigh 7.5 · Sep 17, 2019
• CVE-2019-6826 A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execution on the system ruHigh 7.8 · Sep 17, 2019
• CVE-2019-6811 An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earlier, which could causHigh 7.5 · Sep 17, 2019
• CVE-2019-6810 CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of coHigh 8.8 · Sep 17, 2019
• CVE-2019-6809 A CWE-248: Uncaught Exception vulnerability exists in Modicon M580 (firmware versions prior to V2.90), Modicon M340 (firmware versions prior to V3.10), Modicon High 7.5 · Sep 17, 2019
• CVE-2018-7820 A Credentials Management CWE-255 vulnerability exists in the APC UPS Network Management Card 2 AOS v6.5.6, which could cause Remote Monitoring Credentials to beCritical 9.8 · Sep 17, 2019
• CVE-2018-7817 A Use After Free (CWE-416) vulnerability exists in Zelio Soft 2 v5.1 and prior versions which could cause remote code execution when opening a specially craftedHigh 7.8 · Feb 6, 2019
• CVE-2018-7815 A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on c3core.dll which could cause remote code toHigh 7.8 · Feb 6, 2019
• CVE-2018-7814 A Stack-based Buffer Overflow (CWE-121) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) which could cause remote code to High 7.8 · Feb 6, 2019
• CVE-2018-7813 A Type Confusion (CWE-843) vulnerability exists in Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0) on pcwin.dll which could cause remote code to High 7.8 · Feb 6, 2019
• CVE-2018-7837 An Improper Restriction of XML External Entity Reference ('XXE') vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow tHigh 7.5 · Dec 24, 2018
• CVE-2018-7836 An unrestricted Upload of File with Dangerous Type vulnerability exists on numerous methods of the IIoT Monitor 3.1.38 software that could allow upload and execCritical 9.8 · Dec 24, 2018
• CVE-2018-7835 An Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in IIoT Monitor 3.1.38 which could allow access to files High 7.5 · Dec 24, 2018
• CVE-2018-7832 An Improper Input Validation vulnerability exists in Pro-Face GP-Pro EX v4.08 and previous versions which could cause the execution arbitrary executable when GPHigh 8.8 · Dec 24, 2018
• CVE-2018-7802 A SQL Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could give access to the web interface with full privileges.High 8.8 · Dec 24, 2018
• CVE-2018-7801 A Code Injection vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable access with maximum privileges when a remote code executioHigh 8.8 · Dec 24, 2018
• CVE-2018-7800 A Hard-coded Credentials vulnerability exists in EVLink Parking, v3.2.0-12_v1 and earlier, which could enable an attacker to gain access to the device.Critical 9.8 · Dec 24, 2018
• CVE-2018-7793 A Credential Management vulnerability exists in FoxView HMI SCADA (All Foxboro DCS, Foxboro Evo, and IA Series versions prior to Foxboro DCS Control Core ServicHigh 8.7 · Dec 24, 2018