What is the CVSS score of CVE-2019-6820?

CVE-2019-6820 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H. EPSS exploitation probability: 0.3%.

Modicon M100 Firmware CVE-2019-6820

HIGH

Missing Authentication for Critical Function (CWE-306)

2019-05-22 cybersecurity@se.com

Authentication Bypass Modicon M100 Firmware Modicon M200 Firmware Modicon M221 Firmware Atv Imc Drive Controller Firmware Modicon M241 Firmware Modicon M251 Firmware Modicon M258 Firmware Modicon Lmc058 Firmware Modicon Lmc078 Firmware Pacdrive Eco Firmware Pacdrive Pro Firmware Pacdrive Pro2 Firmware

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

High

Lifecycle Timeline

CVE Published

May 22, 2019 - 20:29 cve.org

HIGH 8.2

DescriptionCVE.org

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2

AnalysisAI

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Missing Authentication for Critical Function (CWE-306), which allows attackers to access critical functionality without authentication. A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a specific Ethernet frame is received in all versions of: Modicon M100, Modicon M200, Modicon M221, ATV IMC drive controller, Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, Modicon LMC078, PacDrive Eco ,PacDrive Pro, PacDrive Pro2 Affected products include: Schneider-Electric Modicon M100 Firmware, Schneider-Electric Modicon M200 Firmware, Schneider-Electric Modicon M221 Firmware, Schneider-Electric Atv Imc Drive Controller Firmware, Schneider-Electric Modicon M241 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Require authentication for all sensitive operations, implement defense in depth.