Critical

DATE	CVE	VULNERABILITY TITLE	RISK
2019-05-22	CVE-2019-6808	Missing Authentication for Critical Function vulnerability in Schneider-Electric products A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause a remote code execution by overwriting configuration settings of the controller over Modbus. network low complexity schneider-electric CWE-306 critical	9.8
2019-05-22	CVE-2018-7842	Authentication Bypass by Spoofing vulnerability in Schneider-Electric products A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller. network low complexity schneider-electric CWE-290 critical	9.8
2019-05-22	CVE-2018-7846	Exposure of Resource to Wrong Sphere vulnerability in Schneider-Electric products A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller. network low complexity schneider-electric CWE-668 critical	9.8
2019-05-22	CVE-2018-7847	Improper Authentication vulnerability in Schneider-Electric products A CWE-284: Improper Access Control vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause denial of service or potential code execution by overwriting configuration settings of the controller over Modbus. network low complexity schneider-electric CWE-287 critical	9.8
2019-05-22	CVE-2019-6815	Unspecified vulnerability in Schneider-Electric Modicon Quantum Firmware In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of service or unauthorized modifications of the PLC configuration when using Ethernet/IP protocol. network low complexity schneider-electric critical	9.1
2019-05-22	CVE-2019-6816	Code Injection vulnerability in Schneider-Electric Modicon Quantum Firmware In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with possible Denial of Service when using Modbus protocol. network low complexity schneider-electric CWE-94 critical	9.1