https://www.schneider-electric.com/en/download/document/SEVD-2018-327-01/

https://www.tenable.com/security/research/tra-2018-38

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.  

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information.

An Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability exists in the embedded web servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR0200 allowing an attacker to craft a URL containing JavaScript that will be executed within the user's browser, potentially impacting the machine the browser is running on.

The remote web server appears to be a Modicon Quantum controller vulnerable to a reflected cross-site scripting attack. An attacker can leverage this issue to inject arbitrary HTML and script code into a user's browser to be executed within the security context of the affected device.

ID	Name	Product	Family	Severity
500245	Schneider (CVE-2018-7810)	Tenable.ot	Tenable.ot	medium
720245	Schneider Electric Modicon Multiple Controllers Cross-Site Scripting	Nessus Network Monitor	SCADA	medium
119147	Modicon Quantum HTTP Server 'formTest' 'name' Parameter XSS	Nessus	SCADA	medium

CVE-2018-7810

medium

Tenable Plugins

medium

medium

medium