CVE-2015-6461 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2015-6461

Modified

More Info Official Page

Source-ics-cert@hq.dhs.gov

Published At-21 Mar, 2019 | 19:29

Updated At-10 Apr, 2024 | 12:28

Remote file inclusion allows an attacker to craft a specific URL referencing the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC web server, which, when launched, will result in the browser redirecting to a remote file via a Java script loaded with the web page.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	5.4	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary	2.0	5.5	MEDIUM	AV:N/AC:L/Au:S/C:P/I:P/A:N

CPE Matches

Schneider Electric SE

>>bmxnoc0401_firmware>>-

cpe:2.3:o:schneider-electric:bmxnoc0401_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnoc0401>>-

cpe:2.3:h:schneider-electric:bmxnoc0401:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnoe0100_firmware>>-

cpe:2.3:o:schneider-electric:bmxnoe0100_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnoe0100>>-

cpe:2.3:h:schneider-electric:bmxnoe0100:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnoe0110_firmware>>-

cpe:2.3:o:schneider-electric:bmxnoe0110_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnoe0110>>-

cpe:2.3:h:schneider-electric:bmxnoe0110:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnoe0110h_firmware>>-

cpe:2.3:o:schneider-electric:bmxnoe0110h_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnoe0110h>>-

cpe:2.3:h:schneider-electric:bmxnoe0110h:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnor0200h_firmware>>-

cpe:2.3:o:schneider-electric:bmxnor0200h_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>bmxnor0200h>>-

cpe:2.3:h:schneider-electric:bmxnor0200h:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342020_firmware>>-

cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342020>>-

cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342020h_firmware>>-

cpe:2.3:o:schneider-electric:modicon_m340_bmxp342020h_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342020h>>-

cpe:2.3:h:schneider-electric:modicon_m340_bmxp342020h:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342030_firmware>>-

cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342030>>-

cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp3420302_firmware>>-

cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp3420302>>-

cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp3420302h_firmware>>-

cpe:2.3:o:schneider-electric:modicon_m340_bmxp3420302h_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp3420302h>>-

cpe:2.3:h:schneider-electric:modicon_m340_bmxp3420302h:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342030h_firmware>>-

cpe:2.3:o:schneider-electric:modicon_m340_bmxp342030h_firmware:-:*:*:*:*:*:*:*

Schneider Electric SE

>>modicon_m340_bmxp342030h>>-

cpe:2.3:h:schneider-electric:modicon_m340_bmxp342030h:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	nvd@nist.gov
CWE-98	Secondary	ics-cert@hq.dhs.gov

References

Hyperlink	Source	Resource
https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02	ics-cert@hq.dhs.gov	US Government Resource Third Party Advisory