Schneider Electric Modicom Premium Firmware vulnerabilities

8 CVEs affecting Schneider Electric Modicom Premium Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-7833, published 2018-12-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-7812, published 2018-12-17. High severity, CVSS 7.5. EPSS: 3.7% chance of exploitation in the next 30 days. An Information Exposure through Discrepancy vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where the web server sends different responses…
CVE-2018-7811, published 2018-11-30. Critical severity, CVSS 9.8. EPSS: 3.5% chance of exploitation in the next 30 days. An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the…
CVE-2018-7809, published 2018-11-30. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. An Unverified Password Change vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 which could allow an unauthenticated remote user to access the…
CVE-2018-7830, published 2018-11-30. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where…
CVE-2018-7833, published 2018-12-17. High severity, CVSS 7.5. EPSS: 1.4% chance of exploitation in the next 30 days. An Improper Check for Unusual or Exceptional Conditions vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where an unauthenticated user can…
CVE-2018-7810, published 2018-11-30. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200…
CVE-2018-7804, published 2018-12-17. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. A URL Redirection to Untrusted Site vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 where a user clicking on a specially crafted link can be…
CVE-2018-7831, published 2018-11-30. High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days. An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an…