Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Weak Password Recovery Mechanism for Forgotten Password vulnerability exists on Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior which could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker.

Schneider Electric is aware of a vulnerability in its Modicon Managed Switch products. The Modicon Managed Switch products are designed for the special requirements of industrial automation. The devices allow users to set up switched Industrial Ethernet networks. Failure to apply the firmware upgrade or mitigations provided below may allow an attacker to change the password of any user, which could cause all or part of the switch to be controlled by the attacker. That could result in various attack types like denial of service or provide access to unauthorized devices on the network.