CVE-2019-6820: Schneider Electric Atv Imc Drive Controller Firmware

High severity, CVSS 8.2. EPSS: 1.3% chance of exploitation in the next 30 days.

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2

Affected products

• Schneider Electric Atv Imc Drive Controller Firmware: any version
• Schneider Electric Modicon LMC058 Firmware: any version
• Schneider Electric Modicon LMC078 Firmware: any version
• Schneider Electric Modicon m100 Firmware: any version
• Schneider Electric Modicon m200 Firmware: any version
• Schneider Electric Modicon m221 Firmware: any version
• Schneider Electric Modicon m241 Firmware: any version
• Schneider Electric Modicon m251 Firmware: any version
• Schneider Electric Modicon m258 Firmware: any version
• Schneider Electric Pacdrive Eco Firmware: any version
• Schneider Electric Pacdrive PRO2 Firmware: any version
• Schneider Electric Pacdrive Pro Firmware: any version

Published 2019-05-22. Last modified 2026-06-17.