What’s Vulnerable › Vulnerabilities

CVE-2018-7810

• Severity: medium (CVSS 6.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-11-30 · updated 2026-06-17
• Weakness: CWE-79

Description

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.

Affected products

• Schneider-Electric Modicom Bmxnor0200H Firmware: all versions
• Schneider-Electric Modicom M340 Firmware: all versions
• Schneider-Electric Modicom Premium Firmware: all versions
• Schneider-Electric Modicom Quantum Firmware: all versions

References

• https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/
• https://www.tenable.com/security/research/tra-2018-38
• https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/
• https://www.tenable.com/security/research/tra-2018-38

Get alerted when CVE-2018-7810 or the next vulnerability affects your stack