CVE-2019-6855

Published: Jan 6, 2020Modified: Jun 17, 2026

7.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Exploitability: 3.9 / Impact: 3.4

Source: NVD

Description

Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.

Affected (24)

Schneider Electric

23 products

Ecostruxure Control Expert

Unity Pro

Modicon M580 Bmep584040 Firmware

Modicon M580 Bmeh584040 Firmware

Modicon M580 Bmep586040 Firmware

Modicon M580 Bmeh586040 Firmware

Modicon M580 Bmep581020 Firmware

Modicon M580 Bmep582020 Firmware

Modicon M580 Bmep582040 Firmware

Modicon M580 Bmep583020 Firmware

Modicon M580 Bmep583040 Firmware

Modicon M580 Bmep584020 Firmware

Modicon M580 Bmep585040 Firmware

Modicon M580 Bmeh582040 Firmware

Modicon M580 Bmep584040s Firmware

Modicon M580 Bmeh584040s Firmware

Modicon M580 Bmeh586040s Firmware

Modicon M580 Bmep582040s Firmware

Modicon M340 Bmxp342020 Firmware

Modicon M340 Bmxp342000 Firmware

Modicon M340 Bmxp341000 Firmware

Modicon M340 Bmxp3420102 Firmware

Modicon M340 Bmxp3420302 Firmware

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Schneider Electric Ecostruxure Control Expert	Before 14.1
Schneider Electric Ecostruxure Control Expert	Version 14.1
Schneider Electric Unity Pro	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep584040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep584040	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh584040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh584040	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep586040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep586040	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh586040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh586040	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep581020 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep581020	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582020 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582020	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582040	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep583020 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep583020	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep583040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep583040	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep584020 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep584020	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep585040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep585040	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh582040 Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh582040	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep584040s Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep584040s	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh584040s Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh584040s	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmeh586040s Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmeh586040s	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M580 Bmep582040s Firmware	Before 3.10

Running on/with	Platform Versions
Schneider Electric Modicon M580 Bmep582040s	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342020 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342020	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342000 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342000	All versions

Configuration U

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp341000 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp341000	All versions

Configuration V

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420102 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420102	All versions

Configuration W

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420302 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420302	All versions

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://www.se.com/ww/en/download/document/SEVD-2019-344-02/

Source: cybersecurity@se.com

Vendor Advisory

https://www.se.com/ww/en/download/document/SEVD-2019-344-02/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.