Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111 140NOE77101 and 140NWM10000; M340 BMXNOC0401 BMXNOE0100x and BMXNOE011xx; and Premium TSXETY4103 TSXETY5103 and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands as demonstrated by modifying HTTP credentials.