CVE-2019-6810

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

CWE-284: Improper Access Control vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmware versions), which could cause the execution of commands by unauthorized users when using IEC 60870-5-104 protocol.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
Schneider Electric SE	BMXNOR0200H Ethernet / Serial RTU module	all firmware versions

References

https://security.cse.iitk.ac.in/responsible-disclosureThird Party Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2019-225-03/Vendor Advisory
https://security.cse.iitk.ac.in/responsible-disclosureThird Party Advisory
https://www.schneider-electric.com/en/download/document/SEVD-2019-225-03/Vendor Advisory

Timeline

Published: Sep 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-68117.5An Improper Check for Unusual or Exceptional Conditions (CWE-754) vulnerability exists in Modicon Quantum 140 NOE771x1 version 6.9 and earli CVE-2019-68127.2A CWE-798 use of hardcoded credentials vulnerability exists in BMX-NOR-0200H with firmware versions prior to V1.7 IR 19 which could cause a CVE-2019-68137.5A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in BMXNOR0200H Ethernet / Serial RTU module (all firmwa CVE-2019-68149.8A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impa CVE-2019-68159.1In Modicon Quantum all firmware versions, CWE-264: Permissions, Privileges, and Access Control vulnerabilities could cause a denial of servi CVE-2019-68169.1In Modicon Quantum all firmware versions, a CWE-94: Code Injection vulnerability could cause an unauthorized firmware modification with poss CVE-2019-68197.5A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a possible Denial of Service when spe CVE-2019-68208.2A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP CVE-2019-68216.5CWE-330: Use of Insufficiently Random Values vulnerability, which could cause the hijacking of the TCP connection when using Ethernet commun CVE-2019-68227.8A Use After Free: CWE-416 vulnerability exists in Zelio Soft 2, V5.2 and earlier, which could cause remote code execution when opening a spe CVE-2019-68239.8A CWE-94: Code Injection vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow an unauthenticated, remote CVE-2019-68249.8A CWE-119: Buffer Errors vulnerability exists in ProClima (all versions prior to version 8.0.0) which allows an unauthenticated, remote atta