CVSS 3.0
5.4 mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:NCVE-2015-6461
Medium (5.4) in schneider-electric. EPSS 0.9% chance of exploitation in the next 30 days.
Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 58% of CVEs (scores of 2026-11-01)
- CWEs
- CWE-20, CWE-98
- Published
- Modified
- Record from
- the NVD, synced
Affected
- schneider-electric:bmxnoc0401_firmware
- schneider-electric:bmxnoe0100_firmware
- schneider-electric:bmxnoe0110_firmware
- schneider-electric:bmxnoe0110h_firmware
- schneider-electric:bmxnor0200h_firmware
- schneider-electric:modicon_m340_bmxp342020_firmware
- schneider-electric:modicon_m340_bmxp342020h_firmware
- schneider-electric:modicon_m340_bmxp3420302_firmware
- schneider-electric:modicon_m340_bmxp3420302h_firmware
- schneider-electric:modicon_m340_bmxp342030_firmware
- schneider-electric:modicon_m340_bmxp342030h_firmware