NetSight
IP …
medium5.4

CVE-2015-6461

Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BM…

Impact

Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.

Affected products

VendorProductAffected versions
Schneider-ElectricBmxnoc0401 Firmware
All versions
Schneider-ElectricBmxnoe0100 Firmware
All versions
Schneider-ElectricBmxnoe0110 Firmware
All versions
Schneider-ElectricBmxnoe0110h Firmware
All versions
Schneider-ElectricBmxnor0200h Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342020 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342020h Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342030 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp3420302 Firmware
All versions
Schneider-ElectricModicon M340 Bmxp3420302h Firmware
All versions
Schneider-ElectricModicon M340 Bmxp342030h Firmware
All versions

Weakness classification

CWE-98CWE-20

References