QID 590517

Date Published: 2021-10-14

QID 590517: Schneider Electric Quantum Ethernet Module Hard-Coded Credentials (Update B) Vulnerability (ICSA-12-018-01B)

AFFECTED PRODUCTS
The following products and versions are affected:
Quantum
140NOE77101 Firmware V4.9 and all previous versions,
140NOE77111 Firmware V5.0 and all previous versions,
140NOE77100 Firmware V3.4 and all previous versions,
140NOE77110 Firmware V3.3 and all previous versions,
140CPU65150 Firmware V3.5 and all previous versions,
140CPU65160 Firmware V3.5 and all previous versions,
140CPU65260 Firmware V3.5 and all previous versions,
140NOC77100 Firmware V1.01 and all previous versions, and
140NOC77101 Firmware V1.01 and all previous versions.
Any available conformal-coated versions of the above part numbers.
Premium
TSXETY4103 Firmware V5.0 and all previous versions,
TSXETY5103 Firmware V5.0 and all previous versions,
TSXP571634M Firmware V4.9 and all previous versions,
TSXP572634M Firmware V4.9 and all previous versions,
TSXP573634M Firmware V4.9 and all previous versions,
TSXP574634M Firmware V3.5 and all previous versions,
TSXP575634M Firmware V3.5 and all previous versions,
TSXP576634M Firmware V3.5 and all previous versions, and
TSXETC101 Firmware V1.01 and all previous versions.
Any available conformal-coated versions of the above part numbers.
M340
BMXNOE0100 Firmware V2.3 and all previous versions,
BMXNOE0110 Firmware V4.65 and all previous versions, and
BMXNOC0401 Firmware V1.01 and all previous versions.
The following products are affected by the FTP Service vulnerabilities only (not affected by Telnet or Windriver Debug vulnerabilities)
:
STBNIC2212 Firmware V2.10 and all previous versions,
STBNIP2311 Firmware V3.01 and all previous versions,
STBNIP2212 Firmware V2.73 and all previous versions,
BMXP342020 Firmware V2.2 and all previous versions, and
BMXP342030 Firmware V2.2 and all previous versions.

QID Detection Logic (Authenticated):
QID checks for the Vulnerable version of using passive scanning

Successful exploitation of these vulnerabilities may allow an attacker to gain elevated privileges, to load a modified firmware, or to perform other malicious activities on the system.

  • CVSS V2 rated as Critical - 10 severity.
    • Solution

    Customers are advised to refer to CERT MITIGATIONS section ICSA-12-018-01B for affected packages and patching details.

    Vendor References

    CVEs related to QID 590517

    CVE-2011-4859 |
    Software Advisories
    Advisory ID Software Component Link
    ICSA-12-018-01B URL Logo www.us-cert.gov/ics/advisories/ICSA-12-018-01B
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].