CVE-2015-6462

moderate-risk

Published 2019-03-21

Reflected Cross-Site Scripting (nonpersistent) allows an attacker to craft a specific URL, which contains Java script that will be executed on the Schneider Electric Modicon BMXNOC0401, BMXNOE0100, BMXNOE0110, BMXNOE0110H, BMXNOR0200H, BMXP342020, BMXP342020H, BMXP342030, BMXP3420302, BMXP3420302H, or BMXP342030H PLC client browser.

Do I need to act?

0.38% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.4/10 Medium

NETWORK / LOW complexity

Affected Products (11)

Bmxnoc0401 Firmware

Bmxnoe0100 Firmware

Bmxnoe0110 Firmware

Bmxnoe0110H Firmware

Bmxnor0200H Firmware

Modicon M340 Bmxp342020 Firmware

Modicon M340 Bmxp342020H Firmware

Modicon M340 Bmxp342030 Firmware

Modicon M340 Bmxp3420302 Firmware

Modicon M340 Bmxp3420302H Firmware

Modicon M340 Bmxp342030H Firmware

Affected Vendors

Schneider-Electric

References (2)

Third Party Advisory https://ics-cert.us-cert.gov/advisories/ICSA-15-246-02

/ 100

moderate-risk

Severity 21/34 · High

Exploitability 1/34 · Minimal

Exposure 16/34 · Moderate