Schneider Electric Modicon Controllers (Update A)
Successful exploitation of this vulnerability could allow an attacker to cause a victim's browser to run arbitrary JavaScript when visiting a page containing injected payload.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-6528US | medium6.1 | — | ||
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting… | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-24-354-07 JSONself
- ICSA Advisory ICSA-24-354-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (6)
- MitigationSchneider Electric Modicon Controllers M241
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- MitigationSchneider Electric Modicon Controllers M251
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- MitigationSchneider Electric Modicon Controllers M258 / LMC058
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- MitigationSchneider Electric Modicon Controllers M262
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- FixedSchneider Electric Modicon Controllers M258 / LMC058
Schneider Electric Modicon Controllers Version prior to v5.2.11.24, Schneider Electric Modicon Controllers M258 / LMC058 All versions , Schneider Electric Modicon Controllers M262 Versions prior to v5.2.8.26, Schneider Electric Modicon Controllers Version prior to v5.2.11.24: Modicon Controller M262 Firmware version 5.2.8.26 delivered with EcoStruxure Machine Expert v2.2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machineexpert-software/ On the engineering workstation, update to v2.2.2 of EcoStruxure Machine Expert. By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot .
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - FixedSchneider Electric Modicon Controllers M262
Schneider Electric Modicon Controllers M262 Versions prior to v5.2.8.26: Modicon Controller M262 Firmware version 5.2.8.26 delivered with EcoStruxure Machine Expert v2.2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2.2 of EcoStruxure Machine Expert. Update Modicon Controller M262 to the latest Firmware and perform reboot
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan