CVE-2019-6855: Schneider Electric Ecostruxure Control Expert
High severity, CVSS 7.3. EPSS: 1% chance of exploitation in the next 30 days.
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
Affected products
- Schneider Electric Ecostruxure Control Expert: before 14.1 (fixed in 14.1); version 14.1 only
- Schneider Electric Modicon m340 BMXP341000 Firmware: before 3.20 (fixed in 3.20)
- Schneider Electric Modicon m340 BMXP342000 Firmware: before 3.20 (fixed in 3.20)
- Schneider Electric Modicon m340 BMXP3420102 Firmware: before 3.20 (fixed in 3.20)
- Schneider Electric Modicon m340 BMXP342020 Firmware: before 3.20 (fixed in 3.20)
- Schneider Electric Modicon m340 BMXP3420302 Firmware: before 3.20 (fixed in 3.20)
- Schneider Electric Modicon m580 BMEH582040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEH584040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEH584040S Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEH586040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEH586040S Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP581020 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP582020 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP582040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP582040S Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP583020 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP583040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP584020 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP584040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP584040S Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP585040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Modicon m580 BMEP586040 Firmware: before 3.10 (fixed in 3.10)
- Schneider Electric Unity Pro: any version
Published 2020-01-06. Last modified 2026-06-17.