CVE-2018-7810: Schneider Electric Modicom BMXNOR0200H Firmware

Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days.

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.

Affected products

• Schneider Electric Modicom BMXNOR0200H Firmware: any version
• Schneider Electric Modicom m340 Firmware: any version
• Schneider Electric Modicom Premium Firmware: any version
• Schneider Electric Modicom Quantum Firmware: any version

Published 2018-11-30. Last modified 2026-06-17.