CVSS 3.1
8.2 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:HCVE-2019-6820
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2
Severity
- EPSS
- 1.3% chance of exploitation in the next 30 days; higher than 69% of CVEs (scores of 2026-10-31)
- CWE
- CWE-306
- Published
- Modified
- Record from
- the NVD, synced
Affected
- schneider-electric:atv_imc_drive_controller_firmware
- schneider-electric:modicon_lmc058_firmware
- schneider-electric:modicon_lmc078_firmware
- schneider-electric:modicon_m100_firmware
- schneider-electric:modicon_m200_firmware
- schneider-electric:modicon_m221_firmware
- schneider-electric:modicon_m241_firmware
- schneider-electric:modicon_m251_firmware
- schneider-electric:modicon_m258_firmware
- schneider-electric:pacdrive_eco_firmware
- schneider-electric:pacdrive_pro2_firmware
- schneider-electric:pacdrive_pro_firmware