CVE-2019-6851

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 29.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-10-29 · updated 2026-06-17
Weakness: CWE-538

Description

A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information from the controller when using TFTP protocol.

Affected products

Schneider-Electric Modicon M340 Firmware: all versions
Schneider Electric SE Modicon M580: all versions
Schneider-Electric Tsxmcpc002M Firmware: all versions
Schneider-Electric Tsxmcpc512K Firmware: all versions
Schneider-Electric Tsxmfp0128P2 Firmware: all versions
Schneider-Electric Tsxmfp064P2 Firmware: all versions
Schneider-Electric Tsxmfpp001M Firmware: all versions
Schneider-Electric Tsxmfpp002M Firmware: all versions
Schneider-Electric Tsxmfpp004M Firmware: all versions
Schneider-Electric Tsxmfpp224K Firmware: all versions
Schneider-Electric Tsxmfpp384K Firmware: all versions
Schneider-Electric Tsxmfpp512K Firmware: all versions
Schneider-Electric Tsxmrpc001M Firmware: all versions
Schneider-Electric Tsxmrpc002M Firmware: all versions
Schneider-Electric Tsxmrpc003M Firmware: all versions
Schneider-Electric Tsxmrpc007M Firmware: all versions
Schneider-Electric Tsxmrpc01M7 Firmware: all versions
Schneider-Electric Tsxmrpc448K Firmware: all versions
Schneider-Electric Tsxmrpc768K Firmware: all versions
Schneider-Electric Tsxmrpf004M Firmware: all versions
Schneider-Electric Tsxmrpf008M Firmware: all versions
Schneider-Electric Tsxmrpp224K Firmware: all versions
Schneider-Electric Tsxmrpp384K Firmware: all versions

References

Get alerted when CVE-2019-6851 or the next vulnerability affects your stack