Details of VAR-201905-0033

ID

VAR-201905-0033

CVE

CVE-2019-6815

TITLE

Modicon Quantum Vulnerabilities related to authorization, permissions, and access control

Trust: 0.8

sources: JVNDB: JVNDB-2019-004763

DESCRIPTION

In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of service or unauthorized modifications of the PLC configuration when using Ethernet/IP protocol. Modicon Quantum is a process control programmable controller (PLC). Schneider Electric Modicon Quantum Is the French Schneider Electric ( Schneider Electric ) company's large programmable logic controller ( PLC )

Trust: 2.43

sources: NVD: CVE-2019-6815 // JVNDB: JVNDB-2019-004763 // CNVD: CNVD-2019-15936 // IVD: 6f414f7a-5a36-49a0-9684-16caf72de6c2 // VULHUB: VHN-158250

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 6f414f7a-5a36-49a0-9684-16caf72de6c2 // CNVD: CNVD-2019-15936

AFFECTED PRODUCTS

vendor:	schneider electric	model:	modicon quantum	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon quantum plc	scope:	-	version:	-	Trust: 0.8
vendor:	schneider	model:	electric modicon quantum	scope:	-	version:	-	Trust: 0.6
vendor:	modicon quantum	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 6f414f7a-5a36-49a0-9684-16caf72de6c2 // CNVD: CNVD-2019-15936 // JVNDB: JVNDB-2019-004763 // NVD: CVE-2019-6815

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-6815
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2019-6815
value:	CRITICAL
Trust: 0.8
CNVD:	CNVD-2019-15936
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201905-929
value:	CRITICAL
Trust: 0.6
IVD:	6f414f7a-5a36-49a0-9684-16caf72de6c2
value:	CRITICAL
Trust: 0.2
VULHUB:	VHN-158250
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2019-6815
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2019-15936
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	6f414f7a-5a36-49a0-9684-16caf72de6c2
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2
VULHUB:	VHN-158250
severity:	MEDIUM
baseScore:	6.4
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2019-6815
baseSeverity:	CRITICAL
baseScore:	9.1
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.2
version:	3.0
Trust: 1.8

sources: IVD: 6f414f7a-5a36-49a0-9684-16caf72de6c2 // CNVD: CNVD-2019-15936 // VULHUB: VHN-158250 // JVNDB: JVNDB-2019-004763 // CNNVD: CNNVD-201905-929 // NVD: CVE-2019-6815

PROBLEMTYPE DATA

problemtype:	NVD-CWE-noinfo	Trust: 1.0
problemtype:	CWE-264	Trust: 0.9

sources: VULHUB: VHN-158250 // JVNDB: JVNDB-2019-004763 // NVD: CVE-2019-6815

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201905-929

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201905-929

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-004763

PATCH

title:	SEVD-2019-134-09	url:	https://www.schneider-electric.com/en/download/document/SEVD-2019-134-09/	Trust: 0.8
title:	Patch for Modicon Quantum Permissions and Access Control Vulnerabilities	url:	https://www.cnvd.org.cn/patchInfo/show/162451	Trust: 0.6

sources: CNVD: CNVD-2019-15936 // JVNDB: JVNDB-2019-004763

EXTERNAL IDS

db:	NVD	id:	CVE-2019-6815	Trust: 3.3
db:	SCHNEIDER	id:	SEVD-2019-134-09	Trust: 1.7
db:	CNNVD	id:	CNNVD-201905-929	Trust: 0.9
db:	CNVD	id:	CNVD-2019-15936	Trust: 0.8
db:	JVNDB	id:	JVNDB-2019-004763	Trust: 0.8
db:	IVD	id:	6F414F7A-5A36-49A0-9684-16CAF72DE6C2	Trust: 0.2
db:	VULHUB	id:	VHN-158250	Trust: 0.1

sources: IVD: 6f414f7a-5a36-49a0-9684-16caf72de6c2 // CNVD: CNVD-2019-15936 // VULHUB: VHN-158250 // JVNDB: JVNDB-2019-004763 // CNNVD: CNNVD-201905-929 // NVD: CVE-2019-6815

REFERENCES

url:	https://www.schneider-electric.com/en/download/document/sevd-2019-134-09/	Trust: 1.7
url:	https://nvd.nist.gov/vuln/detail/cve-2019-6815	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6815	Trust: 0.8
url:	https://web.nvd.nist.gov//vuln/detail/cve-2019-6815	Trust: 0.6

sources: CNVD: CNVD-2019-15936 // VULHUB: VHN-158250 // JVNDB: JVNDB-2019-004763 // CNNVD: CNNVD-201905-929 // NVD: CVE-2019-6815

SOURCES

db:	IVD	id:	6f414f7a-5a36-49a0-9684-16caf72de6c2
db:	CNVD	id:	CNVD-2019-15936
db:	VULHUB	id:	VHN-158250
db:	JVNDB	id:	JVNDB-2019-004763
db:	CNNVD	id:	CNNVD-201905-929
db:	NVD	id:	CVE-2019-6815

LAST UPDATE DATE

2024-11-23T21:37:24.959000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2019-15936	date:	2019-05-30T00:00:00
db:	VULHUB	id:	VHN-158250	date:	2020-08-24T00:00:00
db:	JVNDB	id:	JVNDB-2019-004763	date:	2019-06-07T00:00:00
db:	CNNVD	id:	CNNVD-201905-929	date:	2020-08-25T00:00:00
db:	NVD	id:	CVE-2019-6815	date:	2024-11-21T04:47:12.783

SOURCES RELEASE DATE

db:	IVD	id:	6f414f7a-5a36-49a0-9684-16caf72de6c2	date:	2019-05-30T00:00:00
db:	CNVD	id:	CNVD-2019-15936	date:	2019-05-30T00:00:00
db:	VULHUB	id:	VHN-158250	date:	2019-05-22T00:00:00
db:	JVNDB	id:	JVNDB-2019-004763	date:	2019-06-07T00:00:00
db:	CNNVD	id:	CNNVD-201905-929	date:	2019-05-22T00:00:00
db:	NVD	id:	CVE-2019-6815	date:	2019-05-22T20:29:02.027