CVE-2019-6852
Status: ModifiedHigh (7.5)—
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
CVSS
- Version: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Base score: 7.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.38%
- Percentile among all scored CVEs: 71
- Score date: 10/6/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (10)
Schneider-electric — 140 Cpu6x FirmwareSchneider-electric — 140 NOC 77101 FirmwareSchneider-electric — 140 NOC 78x00 FirmwareSchneider-electric — 140 NOE 771x1 FirmwareSchneider-electric — BMX NOC 0401 FirmwareSchneider-electric — BMX NOE 0100 FirmwareSchneider-electric — BMX NOE 0110 FirmwareSchneider-electric — BMX P34x FirmwareSchneider-electric — TSX ETY X103 FirmwareSchneider-electric — TSX P57x Firmware
CWEs
- CWE-200
- CWE-200
References
Raw JSON (NVD)
Show
{
"id": "CVE-2019-6852",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2019-6852",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-05-28T19:38:28.655664Z"
}
}
],
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "LOW",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
},
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 3.6,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cybersecurity@se.com",
"affectedData": [
{
"vendor": "Schneider Electric",
"product": "Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions)",
"versions": [
{
"status": "affected",
"version": "Modicon Controllers (M340 CPUs"
},
{
"status": "affected",
"version": "M340 communication modules"
},
{
"status": "affected",
"version": "Premium CPUs"
},
{
"status": "affected",
"version": "Premium communication modules"
},
{
"status": "affected",
"version": "Quantum CPUs"
},
{
"status": "affected",
"version": "Quantum communication modules - see security notification for specific versions)"
}
]
}
]
}
],
"published": "2019-11-20T22:15:12.030",
"references": [
{
"url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/",
"tags": [
"Not Applicable",
"Vendor Advisory"
],
"source": "cybersecurity@se.com"
},
{
"url": "https://www.se.com/ww/en/download/document/SEVD-2019-316-02%20/",
"tags": [
"Vendor Advisory"
],
"source": "nvd@nist.gov"
},
{
"url": "https://www.schneider-electric.com/ww/en/download/document/SEVD-2019-281-02/",
"tags": [
"Not Applicable",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cybersecurity@se.com",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-200"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network."
},
{
"lang": "es",
"value": "Una CWE-200: Se presenta una vulnerabilidad de Exposición de Información en los Controladores Modicon (CPU M340, módulos de comunicación M340, CPU Premium, módulos de comunicación Premium, CPU Quantum, módulos de comunicación Quantum; consulte la notificación de seguridad para versiones específicas), lo que podría causar una divulgación de credenciales embebidas en FTP cuando se utiliza el servidor web del controlador en una red no segura."
}
],
"lastModified": "2026-06-17T02:39:47.933",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:bmx_p34x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "14850FBA-6534-47DB-963A-9D1973CD743E"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:bmx_p34x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "31641D9C-5A26-4632-AF77-DF0596027EBF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:bmx_noe_0100_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "357C2EC3-AF99-4C28-9F25-7535B6279039"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:bmx_noe_0100:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "2E25BD42-AEA0-4834-8EF6-A030F34F3C0E"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:bmx_noe_0110_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "245BC693-0C80-433D-B966-7EEC40BDF4B2"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:bmx_noe_0110:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8F06E131-2AAE-4A34-AA96-A4828C01E9FB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:bmx_noc_0401_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0A897B7E-4CBC-48F5-BAF0-D127A73E287C"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:bmx_noc_0401:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "790F8548-142B-4F0E-9A1E-B4570DA76917"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:tsx_p57x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0194B54A-6A29-4539-8BD3-0A0CCC04DB59"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:tsx_p57x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1556D664-D4CF-4B0E-A2AD-262B511F1FBF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:tsx_ety_x103_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2B550F75-2542-4DED-A588-3D7783652B8D"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:tsx_ety_x103:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E63E90D7-795C-4B98-91D5-BD11DCA34AFA"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:140_cpu6x_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3C678406-4896-4209-B75C-49D4A946DBF1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:140_cpu6x:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BF08312C-4614-4FE1-AE24-21E1F6E6D3BF"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:140_noe_771x1_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6090B04C-F4C2-4261-896A-F70019DCD5BC"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:140_noe_771x1:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "22AB350E-16AF-433A-A4B6-409DE325B63D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:140_noc_78x00_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7B735DC2-F3B6-4F16-9747-665466B43EC6"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:140_noc_78x00:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "65ED8C96-0B54-4BB6-BFD6-71D54905C517"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:schneider-electric:140_noc_77101_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6EDC7834-486B-4B72-A18D-C6B900F7D090"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:schneider-electric:140_noc_77101:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E7F4A0D3-FD4D-47E9-B4A6-C78348464907"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cybersecurity@se.com"
}