CVSS 3.1
7.5 highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NCVE-2019-6852
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Severity
- EPSS
- 1.4% chance of exploitation in the next 30 days; higher than 72% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- schneider-electric:140_cpu6x_firmware
- schneider-electric:140_noc_77101_firmware
- schneider-electric:140_noc_78x00_firmware
- schneider-electric:140_noe_771x1_firmware
- schneider-electric:bmx_noc_0401_firmware
- schneider-electric:bmx_noe_0100_firmware
- schneider-electric:bmx_noe_0110_firmware
- schneider-electric:bmx_p34x_firmware
- schneider-electric:tsx_ety_x103_firmware
- schneider-electric:tsx_p57x_firmware