CVE-2018-7804

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-17 · updated 2026-06-17
Weakness: CWE-601

Description

A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be redirected to a URL of the attacker's choosing.

Affected products

Schneider-Electric Modicom Bmxnor0200H Firmware: all versions
Schneider-Electric Modicom M340 Firmware: all versions
Schneider-Electric Modicom Premium Firmware: all versions
Schneider-Electric Modicom Quantum Firmware: all versions

References

https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/
https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/

Get alerted when CVE-2018-7804 or the next vulnerability affects your stack