CVE-2019-6852 in Modicon M340 CPU
Summary
by MITRE
A CWE-200: Information Exposure vulnerability exists in Modicon Controllers (M340 CPUs, M340 communication modules, Premium CPUs, Premium communication modules, Quantum CPUs, Quantum communication modules - see security notification for specific versions), which could cause the disclosure of FTP hardcoded credentials when using the Web server of the controller on an unsecure network.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/29/2026
The vulnerability identified as CVE-2019-6852 represents a critical information exposure flaw affecting several Modicon controller models including M340 CPUs and communication modules, Premium CPUs and modules, and Quantum CPUs and modules. This weakness resides within the web server implementation of these industrial control systems, specifically when operating over unsecured network connections. The vulnerability is categorized under CWE-200, which defines information exposure as a condition where system information is unintentionally disclosed to unauthorized parties, creating potential attack vectors for malicious actors targeting industrial control environments. The affected controllers are commonly deployed in critical infrastructure sectors including manufacturing, energy, and process control systems where their security is paramount to operational continuity and safety.
The technical flaw manifests when the Modicon controllers utilize their built-in web server functionality to provide remote access and configuration capabilities. During normal operation, these controllers contain hardcoded FTP credentials that are embedded within the firmware to enable automated file transfers and system maintenance operations. When the web server is accessible over an unsecured network without proper encryption or authentication mechanisms, these hardcoded credentials become exposed to network traffic interception. This exposure occurs because the web server implementation fails to adequately protect or obscure these credentials during transmission, allowing any network observer to capture and potentially exploit these hardcoded authentication details for unauthorized access to the controller's file system and administrative functions.
The operational impact of this vulnerability extends beyond simple credential disclosure, as it creates a persistent security risk for industrial control systems that may be exposed to network-based attacks. An attacker who intercepts these hardcoded FTP credentials can gain unauthorized access to controller file systems, potentially enabling them to modify firmware, alter operational parameters, or extract sensitive configuration data. This vulnerability is particularly concerning in industrial environments where controllers manage critical processes, as unauthorized access could lead to operational disruptions, safety hazards, or even physical damage to equipment. The risk is amplified when these controllers are deployed in unsecured network environments where network traffic is not encrypted or monitored, making the hardcoded credentials easily accessible to attackers within the network perimeter.
Organizations should implement multiple layers of mitigation to address this vulnerability effectively. Immediate remediation efforts should focus on securing network access to affected controllers through proper network segmentation, implementing encrypted communication protocols such as HTTPS and SFTP, and ensuring that web server functionality is only accessible through secure, authenticated channels. Network monitoring should be enhanced to detect and alert on unusual FTP traffic patterns or unauthorized access attempts. Additionally, administrators should consider disabling unnecessary web server features when not actively required for system management, and regularly review and update controller firmware to ensure compliance with the latest security patches. The vulnerability aligns with ATT&CK technique T1071.004 for application layer protocol usage and T1566 for credential access, demonstrating how information exposure can lead to broader compromise within industrial control systems. Organizations should also conduct comprehensive security assessments to identify all instances of these controllers within their network infrastructure and ensure proper access controls are implemented across all operational environments.