The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771* and…
Priority MEDIUM 49Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The Schneider Electric Quantum Ethernet Module, as used in the Quantum 140NOE771* and 140CPU65* modules, the Premium TSXETY* and TSXP57* modules, the M340 BMXNOE01* and BMXP3420* modules, and the STB DIO STBNIC2212 and STBNIP2* modules, uses hardcoded passwords for the (1) AUTCSE, (2) AUT_CSE, (3) fdrusers, (4) ftpuser, (5) loader, (6) nic2212, (7) nimrohs2212, (8) nip2212, (9) noe77111_v500, (10) ntpupdate, (11) pcfactory, (12) sysdiag, (13) target, (14) test, (15) USER, and (16) webserver accounts, which makes it easier for remote attackers to obtain access via the (a) TELNET, (b) Windriver Debug, or (c) FTP port.
Why it matters now
EPSS 0.03894 90th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 21
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:quantum_ethernet_module_140cpu65150:*:*:*:*:*:*:*:* | up to 3.5 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:quantum_ethernet_module_140cpu65160:*:*:*:*:*:*:*:* | up to 3.5 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:quantum_ethernet_module_140cpu65260:*:*:*:*:*:*:*:* | up to 3.5 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77100:*:*:*:*:*:*:*:* | up to 3.3; up to 3.4 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77101:*:*:*:*:*:*:*:* | up to 4.9 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77111:*:*:*:*:*:*:*:* | up to 5.0 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxety4103:*:*:*:*:*:*:*:* | up to 5.0 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxety5103:*:*:*:*:*:*:*:* | up to 5.0 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp57163m:*:*:*:*:*:*:*:* | up to 4.9 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp572634m:*:*:*:*:*:*:*:* | up to 4.9 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:quantum_ethernet_module_140cpu65150:*:*:*:*:*:*:*:* Versions up to 3.5 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:quantum_ethernet_module_140cpu65160:*:*:*:*:*:*:*:* Versions up to 3.5 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:quantum_ethernet_module_140cpu65260:*:*:*:*:*:*:*:* Versions up to 3.5 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77100:*:*:*:*:*:*:*:* Versions up to 3.3; up to 3.4 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77101:*:*:*:*:*:*:*:* Versions up to 4.9 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:quantum_ethernet_module_140noe77111:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxety4103:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxety5103:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp57163m:*:*:*:*:*:*:*:* Versions up to 4.9 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp572634m:*:*:*:*:*:*:*:* Versions up to 4.9 Vulnerable ·Schneider Electric
Show 11 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp573634m:*:*:*:*:*:*:*:* | up to 4.9 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp574634m:*:*:*:*:*:*:*:* | up to 3.5 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp575634m:*:*:*:*:*:*:*:* | up to 3.5 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp576634m:*:*:*:*:*:*:*:* | up to 3.5 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxnoe0100:*:*:*:*:*:*:*:* | up to 2.3 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxnoe0110:*:*:*:*:*:*:*:* | up to 4.65 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxp342020:*:*:*:*:*:*:*:* | up to 2.2 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxp342030:*:*:*:*:*:*:*:* | up to 2.2 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:stb_dio_ethernet_module_stbnic2212:*:*:*:*:*:*:*:* | up to 2.10 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:stb_dio_ethernet_module_stbnip2212:*:*:*:*:*:*:*:* | up to 2.73 | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:stb_dio_ethernet_module_stbnip2311:*:*:*:*:*:*:*:* | up to 3.01 | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp573634m:*:*:*:*:*:*:*:* Versions up to 4.9 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp574634m:*:*:*:*:*:*:*:* Versions up to 3.5 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp575634m:*:*:*:*:*:*:*:* Versions up to 3.5 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:premium_ethernet_module_tsxp576634m:*:*:*:*:*:*:*:* Versions up to 3.5 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxnoe0100:*:*:*:*:*:*:*:* Versions up to 2.3 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxnoe0110:*:*:*:*:*:*:*:* Versions up to 4.65 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxp342020:*:*:*:*:*:*:*:* Versions up to 2.2 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:m340_ethernet_module_bmxp342030:*:*:*:*:*:*:*:* Versions up to 2.2 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:stb_dio_ethernet_module_stbnic2212:*:*:*:*:*:*:*:* Versions up to 2.10 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:stb_dio_ethernet_module_stbnip2212:*:*:*:*:*:*:*:* Versions up to 2.73 Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:stb_dio_ethernet_module_stbnip2311:*:*:*:*:*:*:*:* Versions up to 3.01 Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2011-4859
- 2026-10-03 Alias added: GHSA-wrpc-6j6r-gh72
- 2026-10-11 EPSS moved to the 90th–95th percentile
References
Sources
- CVE-2011-4859 · CVE Program
- CVE-2011-4859 · NVD
- FIRST EPSS
- GHSA-wrpc-6j6r-gh72 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences