CVE-2019-6859: Schneider Electric 140 CPU6X Firmware

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.

Affected products

• Schneider Electric 140 CPU6X Firmware: any version
• Schneider Electric 140 Noc 77101 Firmware: any version
• Schneider Electric 140 Noc 78x00 Firmware: any version
• Schneider Electric 140 Noe 771x1 Firmware: any version
• Schneider Electric Bmx Noc 0401 Firmware: any version
• Schneider Electric Bmx Noe 0100 Firmware: any version
• Schneider Electric Bmx Noe 0110 Firmware: any version
• Schneider Electric Bmx p34x Firmware: any version
• Schneider Electric Tsx Ety x103 Firmware: any version
• Schneider Electric Tsx p57x Firmware: any version

Published 2020-04-22. Last modified 2026-06-17.