CVE-2019-6855
An Improper Authorization - CWE-285 vulnerability exists in EcoStruxure? Control Expert V14.0 and...
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
- Record
CVE-2019-6855- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
- Record
CVE-2019-6855- Weakness
- CWE-863
- Updated
- 2026-11-02
EUVDEUVD-2019-16409 No score
Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10), which could cause a bypass of the authentication process between EcoStruxure Control Expert and the M340 and M580 controllers.
- Record
EUVD-2019-16409- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f79p-hq3g-prjw No score
An Improper Authorization - CWE-285 vulnerability exists in EcoStruxure? Control Expert V14.0 and...
An Improper Authorization - CWE-285 vulnerability exists in EcoStruxure? Control Expert V14.0 and all versions of Unity Pro (previously calledEcoStruxure? Control Expert), which could allow a bypass of the authentication process between EcoStruxure Control Expert and the controller.
- Record
GHSA-f79p-hq3g-prjw- Weakness
- CWE-863
- Updated
- 2026-11-02
Affected products
- schneider-electric ecostruxure control expert
- schneider-electric unity pro
- schneider-electric modicon m340 bmxp341000 firmware
- schneider-electric modicon m340 bmxp342000 firmware
- schneider-electric modicon m340 bmxp3420102 firmware
- schneider-electric modicon m340 bmxp342020 firmware
- schneider-electric modicon m340 bmxp3420302 firmware
- schneider-electric modicon m580 bmeh582040 firmware
- schneider-electric modicon m580 bmeh584040 firmware
- schneider-electric modicon m580 bmeh584040s firmware
- schneider-electric modicon m580 bmeh586040 firmware
- schneider-electric modicon m580 bmeh586040s firmware
Show 11 moreShow less
- schneider-electric modicon m580 bmep581020 firmware
- schneider-electric modicon m580 bmep582020 firmware
- schneider-electric modicon m580 bmep582040 firmware
- schneider-electric modicon m580 bmep582040s firmware
- schneider-electric modicon m580 bmep583020 firmware
- schneider-electric modicon m580 bmep583040 firmware
- schneider-electric modicon m580 bmep584020 firmware
- schneider-electric modicon m580 bmep584040 firmware
- schneider-electric modicon m580 bmep584040s firmware
- schneider-electric modicon m580 bmep585040 firmware
- schneider-electric modicon m580 bmep586040 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-6855 is a high vulnerability (CVSS 7.3) in Schneider-electric Ecostruxure Control Expert, published January 6, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.95%, the 61st percentile. No source names a fixed version.