CVE-2019-6849

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-29 · updated 2026-06-17
Weakness: CWE-200

Description

A CWE-200: Information Exposure vulnerability exists in Modicon M580, Modicon BMENOC 0311, and Modicon BMENOC 0321, which could cause the disclosure of sensitive information when using specific Modbus services provided by the REST API of the controller/communication module.

Affected products

Schneider-Electric Modicon Bmenoc 0311 Firmware: all versions
Schneider-Electric Modicon Bmenoc 0321 Firmware: all versions
Schneider Electric SE Modicon M580: all versions

References

https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04
https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-04

Get alerted when CVE-2019-6849 or the next vulnerability affects your stack