What’s Vulnerable › Vulnerabilities

CVE-2015-6462

• Severity: medium (CVSS 5.4 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-03-21 · updated 2026-06-17
• Weakness: CWE-79

Description

Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser.

Affected products

• Schneider-Electric Bmxnoc0401 Firmware: all versions
• Schneider-Electric Bmxnoe0100 Firmware: all versions
• Schneider-Electric Bmxnoe0110 Firmware: all versions
• Schneider-Electric Bmxnoe0110H Firmware: all versions
• Schneider Electric SE BMXNOR0200H Ethernet / Serial RTU module: all versions
• Schneider-Electric Modicon M340 Bmxp342020 Firmware: all versions
• Schneider-Electric Modicon M340 Bmxp342020H Firmware: all versions
• Schneider-Electric Modicon M340 Bmxp3420302 Firmware: all versions
• Schneider-Electric Modicon M340 Bmxp3420302H Firmware: all versions
• Schneider-Electric Modicon M340 Bmxp342030 Firmware: all versions
• Schneider-Electric Modicon M340 Bmxp342030H Firmware: all versions

References

• https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02
• https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02

Get alerted when CVE-2015-6462 or the next vulnerability affects your stack