CVE-2019-6851

—

CVSS 3.1

7.5 high

EPSS

30%p98

Published

Oct 29, 2019 (Oct 29, 2019)

Modified

Jun 17, 2026

Description

A CWE-538: File and Directory Information Exposure vulnerability exists in Modicon M580, Modicon M340, Modicon Premium , Modicon Quantum (all firmware versions), which could cause the disclosure of information from the controller when using TFTP protocol.

Vendors: schneider-electric
Products: modicon m580 firmware, modicon m340 firmware, tsxmcpc002m firmware, tsxmcpc512k firmware, tsxmfpp001m firmware, tsxmfpp002m firmware, tsxmfpp004m firmware, tsxmfpp512k firmware, tsxmrpc001m firmware, tsxmrpc002m firmware, tsxmrpc003m firmware, tsxmrpc007m firmware
Weakness: CWE-538, CWE-200
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

NVD CVE.org GitHub PoCs EPSS (29.9%)

In the news2 stories

Talos experts found 11 flaws in Schneider Electric Modicon Controllers

Security AffairsOct 14, 06:40 UTC · Oct 14, 2019Vulnerability in the wildCVE-2019-6841 CVE-2019-6851 CVE-2019-6848+2 CVEs

Vulnerability spotlight: Multiple vulnerabilities in Schneider Electric Modicon M580

Cisco TalosOct 8, 17:49 UTC · Oct 8, 2019Vulnerability in the wildCVE-2019-6846 CVE-2019-6844 CVE-2019-6843+5 CVEs