CVE-2019-6859
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions...
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
- Record
CVE-2019-6859- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-798
- Updated
- 2026-11-02
CVE List No score
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
- Record
CVE-2019-6859- Weakness
- CWE-798
- Updated
- 2026-11-02
EUVDEUVD-2019-16413 No score
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
- Record
EUVD-2019-16413- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2c7j-2jp5-mx56 No score
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions...
A CWE-798: Use of Hardcoded Credentials vulnerability exists in Modicon Controllers (All versions of the following CPUs and Communication Module product references listed in the Security Notifications), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.Ê
- Record
GHSA-2c7j-2jp5-mx56- Weakness
- CWE-798
- Updated
- 2026-11-02
Affected products
- schneider-electric 140 cpu6x firmware
- schneider-electric 140 noc 77101 firmware
- schneider-electric 140 noc 78x00 firmware
- schneider-electric 140 noe 771x1 firmware
- schneider-electric bmx noc 0401 firmware
- schneider-electric bmx noe 0100 firmware
- schneider-electric bmx noe 0110 firmware
- schneider-electric bmx p34x firmware
- schneider-electric tsx ety x103 firmware
- schneider-electric tsx p57x firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-6859 is a high vulnerability (CVSS 7.5) in Schneider-electric 140 Cpu6x Firmware, published April 22, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. No source names a fixed version.