What’s Vulnerable › Vulnerabilities

CVE-2019-6859

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-04-22 · updated 2026-06-17
• Weakness: CWE-798

Description

A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.

Affected products

• Schneider-Electric 140 Cpu6X Firmware: all versions
• Schneider-Electric 140 Noc 77101 Firmware: all versions
• Schneider-Electric 140 Noc 78X00 Firmware: all versions
• Schneider-Electric 140 Noe 771X1 Firmware: all versions
• Schneider-Electric Bmx Noc 0401 Firmware: all versions
• Schneider-Electric Bmx Noe 0100 Firmware: all versions
• Schneider-Electric Bmx Noe 0110 Firmware: all versions
• Schneider-Electric Bmx P34X Firmware: all versions
• Schneider-Electric Tsx Ety X103 Firmware: all versions
• Schneider-Electric Tsx P57X Firmware: all versions

References

• https://www.se.com/ww/en/download/document/SEVD-2019-316-02
• https://www.se.com/ww/en/download/document/SEVD-2019-316-02

Get alerted when CVE-2019-6859 or the next vulnerability affects your stack