CVE-2019-6855
First published: Mon Jan 06 2020(Updated: )
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider-electric Ecostruxure Control Expert | <14.1 | |
| Schneider-electric Ecostruxure Control Expert | =14.1 | |
| Schneider-electric Unity Pro | ||
| Schneider-electric Modicon M580 Bmep584040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep584040 | ||
| Schneider-electric Modicon M580 Bmeh584040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmeh584040 | ||
| Schneider-electric Modicon M580 Bmep586040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep586040 | ||
| Schneider-electric Modicon M580 Bmeh586040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmeh586040 | ||
| Schneider-electric Modicon M580 Bmep581020 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep581020 | ||
| Schneider-electric Modicon M580 Bmep582020 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep582020 | ||
| Schneider-electric Modicon M580 Bmep582040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep582040 | ||
| Schneider-electric Modicon M580 Bmep583020 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep583020 | ||
| Schneider-electric Modicon M580 Bmep583040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep583040 | ||
| Schneider-electric Modicon M580 Bmep584020 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep584020 | ||
| Schneider-electric Modicon M580 Bmep585040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep585040 | ||
| Schneider-electric Modicon M580 Bmeh582040 Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmeh582040 | ||
| Schneider-electric Modicon M580 Bmep584040s Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep584040s | ||
| Schneider-electric Modicon M580 Bmeh584040s Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmeh584040s | ||
| Schneider-electric Modicon M580 Bmeh586040s Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmeh586040s | ||
| Schneider-electric Modicon M580 Bmep582040s Firmware | <3.10 | |
| Schneider-electric Modicon M580 Bmep582040s | ||
| Schneider-electric Modicon M340 Bmxp3420302 Firmware | <3.20 | |
| Schneider-electric Modicon M340 Bmxp3420302 | ||
| Schneider-electric Modicon M340 Bmxp342020 Firmware | <3.20 | |
| Schneider-electric Modicon M340 Bmxp342020 | ||
| Schneider-electric Modicon M340 Bmxp342000 Firmware | <3.20 | |
| Schneider-electric Modicon M340 Bmxp342000 | ||
| Schneider-electric Modicon M340 Bmxp341000 Firmware | <3.20 | |
| Schneider-electric Modicon M340 Bmxp341000 | ||
| Schneider-electric Modicon M340 Bmxp3420102 Firmware | <3.20 | |
| Schneider-electric Modicon M340 Bmxp3420102 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2019-6855?
CVE-2019-6855 is an Incorrect Authorization vulnerability that exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), and Modicon M580 (all versions prior to V3.10).
How severe is CVE-2019-6855?
CVE-2019-6855 has a severity rating of 7.3 (High).
What software is affected by CVE-2019-6855?
The software affected by CVE-2019-6855 includes EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), and Modicon M580 (all versions prior to V3.10).
How can I fix CVE-2019-6855?
To fix CVE-2019-6855, it is recommended to update the affected software to the latest version.
Where can I find more information about CVE-2019-6855?
You can find more information about CVE-2019-6855 at the following link: [CVE-2019-6855](https://www.se.com/ww/en/download/document/SEVD-2019-344-02/).
- collector/nvd-index
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/schneider-electric
- canonical/schneider-electric ecostruxure control expert
- version/schneider-electric ecostruxure control expert/14.1
- canonical/schneider-electric unity pro
- canonical/schneider-electric modicon m580 bmep584040 firmware
- canonical/schneider-electric modicon m580 bmep584040
- canonical/schneider-electric modicon m580 bmeh584040 firmware
- canonical/schneider-electric modicon m580 bmeh584040
- canonical/schneider-electric modicon m580 bmep586040 firmware
- canonical/schneider-electric modicon m580 bmep586040
- canonical/schneider-electric modicon m580 bmeh586040 firmware
- canonical/schneider-electric modicon m580 bmeh586040
- canonical/schneider-electric modicon m580 bmep581020 firmware
- canonical/schneider-electric modicon m580 bmep581020
- canonical/schneider-electric modicon m580 bmep582020 firmware
- canonical/schneider-electric modicon m580 bmep582020
- canonical/schneider-electric modicon m580 bmep582040 firmware
- canonical/schneider-electric modicon m580 bmep582040
- canonical/schneider-electric modicon m580 bmep583020 firmware
- canonical/schneider-electric modicon m580 bmep583020
- canonical/schneider-electric modicon m580 bmep583040 firmware
- canonical/schneider-electric modicon m580 bmep583040
- canonical/schneider-electric modicon m580 bmep584020 firmware
- canonical/schneider-electric modicon m580 bmep584020
- canonical/schneider-electric modicon m580 bmep585040 firmware
- canonical/schneider-electric modicon m580 bmep585040
- canonical/schneider-electric modicon m580 bmeh582040 firmware
- canonical/schneider-electric modicon m580 bmeh582040
- canonical/schneider-electric modicon m580 bmep584040s firmware
- canonical/schneider-electric modicon m580 bmep584040s
- canonical/schneider-electric modicon m580 bmeh584040s firmware
- canonical/schneider-electric modicon m580 bmeh584040s
- canonical/schneider-electric modicon m580 bmeh586040s firmware
- canonical/schneider-electric modicon m580 bmeh586040s
- canonical/schneider-electric modicon m580 bmep582040s firmware
- canonical/schneider-electric modicon m580 bmep582040s
- canonical/schneider-electric modicon m340 bmxp3420302 firmware
- canonical/schneider-electric modicon m340 bmxp3420302
- canonical/schneider-electric modicon m340 bmxp342020 firmware
- canonical/schneider-electric modicon m340 bmxp342020
- canonical/schneider-electric modicon m340 bmxp342000 firmware
- canonical/schneider-electric modicon m340 bmxp342000
- canonical/schneider-electric modicon m340 bmxp341000 firmware
- canonical/schneider-electric modicon m340 bmxp341000
- canonical/schneider-electric modicon m340 bmxp3420102 firmware
- canonical/schneider-electric modicon m340 bmxp3420102