CVE-2011-4860 describes a critical vulnerability in the Schneider Electric Quantum Ethernet Module (140NOE771*) where the fwupgrade account password is predictably generated from the device's MAC address. This allows remote attackers to easily obtain full access by passively capturing ARP or Neighbor Solicitation messages. With a CVSS score of 10.0, this vulnerability presents a severe risk of complete compromise (confidentiality, integrity, and availability). While no public exploit code or active exploitation has been observed, and community discussion is minimal, the inherent simplicity of exploitation makes it a significant concern.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.3CPE matchmatch criteria | cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77100:*:*:*:*:*:*:*:* | ||
<= 3.4CPE matchmatch criteria | cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77100:*:*:*:*:*:*:*:* | ||
<= 4.9CPE matchmatch criteria | cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77101:*:*:*:*:*:*:*:* | ||
<= 5.0CPE matchmatch criteria | cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77111:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.