CVE-2019-6852

State: Published
Severity: 7.5 High
Published: Nov 20, 2019
Updated: May 28, 2026
Reserved: Jan 25, 2019

Description

A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CISA-ADP

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)Schneider Electric	Modicon Controllers (M340 CPUsAffected M340 communication modulesAffected Premium CPUsAffected Premium communication modulesAffected Quantum CPUsAffected Quantum communication modules - see security notification for specific versions)Affected

References

https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.