CVE-2018-7831: CSRF
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to send a specially crafted URL to a currently authenticated web server user to execute a password change on the web server.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-7831?
CVE-2018-7831 has a medium severity rating affecting the security of the web servers in the specified PLCs.
How do I fix CVE-2018-7831?
To fix CVE-2018-7831, update the firmware of the affected Schneider Electric Modicon devices to the latest version provided by the vendor.
What products are affected by CVE-2018-7831?
CVE-2018-7831 affects the Schneider Electric Modicon M340, Premium, Quantum PLCs, and BMXNOR0200.
What type of vulnerability is CVE-2018-7831?
CVE-2018-7831 is classified as an Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as basic XSS.
Can CVE-2018-7831 be exploited remotely?
Yes, CVE-2018-7831 can be exploited by an attacker who sends a specially crafted URL to an authenticated user of the web server.