Schneider Electric Modicon Controllers (Update A)
Successful exploitation of this vulnerability could allow an attacker to cause a victim's browser to run arbitrary JavaScript when visiting a page containing injected payload.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-6528US | medium6.1 | — | ||
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- ICS Advisory ICSA-24-354-07 JSONself
- ICSA Advisory ICSA-24-354-07 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (6)
- MitigationSchneider Electric Modicon Controllers M241
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- MitigationSchneider Electric Modicon Controllers M251
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- MitigationSchneider Electric Modicon Controllers M258 / LMC058
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- MitigationSchneider Electric Modicon Controllers M262
If users choose not to apply the remediation provided above they should immediately apply the following mitigations to reduce the risk of exploit:
- BehobenSchneider Electric Modicon Controllers M258 / LMC058
Schneider Electric Modicon Controllers Version prior to v5.2.11.24, Schneider Electric Modicon Controllers M258 / LMC058 All versions , Schneider Electric Modicon Controllers M262 Versions prior to v5.2.8.26, Schneider Electric Modicon Controllers Version prior to v5.2.11.24: Modicon Controller M262 Firmware version 5.2.8.26 delivered with EcoStruxure Machine Expert v2.2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machineexpert-software/ On the engineering workstation, update to v2.2.2 of EcoStruxure Machine Expert. By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot .
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - BehobenSchneider Electric Modicon Controllers M262
Schneider Electric Modicon Controllers M262 Versions prior to v5.2.8.26: Modicon Controller M262 Firmware version 5.2.8.26 delivered with EcoStruxure Machine Expert v2.2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2.2 of EcoStruxure Machine Expert. Update Modicon Controller M262 to the latest Firmware and perform reboot
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan