CVE-2019-6859: High severity schneider electric bmx p34x firmware vulnerability
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6859?
The vulnerability CVE-2019-6859 has a severity rating that requires immediate attention due to the potential disclosure of sensitive hardcoded FTP credentials.
How do I fix CVE-2019-6859?
To fix CVE-2019-6859, you should replace the hardcoded credentials with secure, unique credentials and update the firmware of affected Schneider Electric devices.
Which Schneider Electric products are affected by CVE-2019-6859?
CVE-2019-6859 affects various Modicon Controllers, including models like BMX P34X, BMX NOE 0100, BMX NOE 0110, and others listed in the security notifications.
What are the potential risks of CVE-2019-6859?
The risks associated with CVE-2019-6859 include unauthorized access to the device via FTP, leading to potential modifications or data breaches.
Is there a patch available for CVE-2019-6859?
Yes, Schneider Electric has provided firmware updates that address the CVE-2019-6859 vulnerability, which should be implemented as part of the remediation process.