CVE-2015-6461: Input Validation
First published: Thu Mar 21 2019(Updated: )
Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| schneider-electric BMXNOC0401 | ||
| Schneider Electric Modicon M340 BMXNOC0401 | ||
| All of | ||
| Schneider Electric BMXNOE0100 Firmware | ||
| schneider-electric bmxnoe0100 | ||
| All of | ||
| schneider-electric BMXNOE0110H | ||
| schneider-electric BMXNOE0110H | ||
| All of | ||
| Schneider Electric BMXNOE0110H Firmware | ||
| Schneider Electric BMXNOE0110H Firmware | ||
| All of | ||
| Schneider Electric BMXNOR0200H Firmware | ||
| Schneider Electric BMXNOR200H | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP342020 Firmware | ||
| Schneider Electric Modicon M340 BMXP342020 | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP342020H Firmware | ||
| Schneider Electric Modicon M340 BMXP342020H | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP342030 Firmware | ||
| Schneider Electric Modicon M340 BMXP342030H | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP3420302 Firmware | ||
| Schneider Electric Modicon M340 BMXP3420302 Firmware | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP3420302H Firmware | ||
| Schneider Electric Modicon M340 BMXP3420302H Firmware | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP342030H Firmware | ||
| Schneider Electric Modicon M340 BMXP342030H | ||
| schneider-electric BMXNOC0401 | ||
| Schneider Electric Modicon M340 BMXNOC0401 | ||
| Schneider Electric BMXNOE0100 Firmware | ||
| schneider-electric bmxnoe0100 | ||
| schneider-electric BMXNOE0110H | ||
| schneider-electric BMXNOE0110H | ||
| Schneider Electric BMXNOE0110H Firmware | ||
| Schneider Electric BMXNOE0110H Firmware | ||
| Schneider Electric BMXNOR0200H Firmware | ||
| Schneider Electric BMXNOR200H | ||
| schneider-electric BMXP342020H firmware | ||
| schneider-electric BMXP342020H firmware | ||
| schneider-electric BMXP342020H firmware | ||
| schneider-electric BMXP342020H firmware | ||
| Schneider Electric BMXP342030 | ||
| Schneider Electric BMXP342030 | ||
| Schneider Electric BMXP3420302H firmware | ||
| Schneider Electric BMXP3420302H firmware | ||
| Schneider Electric BMXP3420302H firmware | ||
| Schneider Electric BMXP3420302H firmware | ||
| Schneider Electric BMXP342030 Firmware | ||
| schneider-electric BMXP342030H firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2015-6461?
CVE-2015-6461 is a vulnerability that allows remote file inclusion on Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web servers.
How severe is CVE-2015-6461?
CVE-2015-6461 has a severity level of medium (5.4).
How can I exploit CVE-2015-6461?
To exploit CVE-2015-6461, an attacker can craft a specific URL referencing the vulnerable Schneider Electric PLC web server.
What is the potential impact of CVE-2015-6461?
The potential impact of CVE-2015-6461 is that an attacker can gain unauthorized access to sensitive information or perform malicious actions on the affected PLC system.
How can I mitigate CVE-2015-6461?
To mitigate CVE-2015-6461, it is recommended to apply the latest firmware updates provided by Schneider Electric and follow their security guidelines.
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/author
- vendor/schneider-electric
- canonical/schneider-electric bmxnoc0401
- canonical/schneider electric modicon m340 bmxnoc0401
- canonical/schneider electric bmxnoe0100 firmware
- canonical/schneider-electric bmxnoe0100
- canonical/schneider-electric bmxnoe0110h
- canonical/schneider electric bmxnoe0110h firmware
- canonical/schneider electric bmxnor0200h firmware
- canonical/schneider electric bmxnor200h
- canonical/schneider electric modicon m340 bmxp342020 firmware
- canonical/schneider electric modicon m340 bmxp342020
- canonical/schneider electric modicon m340 bmxp342020h firmware
- canonical/schneider electric modicon m340 bmxp342020h
- canonical/schneider electric modicon m340 bmxp342030 firmware
- canonical/schneider electric modicon m340 bmxp342030h
- canonical/schneider electric modicon m340 bmxp3420302 firmware
- canonical/schneider electric modicon m340 bmxp3420302h firmware
- canonical/schneider electric modicon m340 bmxp342030h firmware
- canonical/schneider-electric bmxp342020h firmware
- canonical/schneider electric bmxp342030
- canonical/schneider electric bmxp3420302h firmware
- canonical/schneider electric bmxp342030 firmware
- canonical/schneider-electric bmxp342030h firmware