CVE-2020-7534
Description
A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions), Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions), Modicon M340 ethernet modules: (BMXNOC0401, BMXNOE01, BMXNOR0200H) (All Versions), Modicon Quantum and Premium factory cast communication modules: (140NOE77111, 140NOC78*00, TSXETY5103, TSXETY4103) (All Versions)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicon_m340_bmxp342020_firmware | No range specified | — |
| schneider-electric 140cpu65_firmware | No range specified | — |
| schneider-electric tsxp57_firmware | No range specified | — |
| schneider-electric bmxnoc0401_firmware | No range specified | — |
| schneider-electric bmxnoe01_firmware | No range specified | — |
| schneider-electric bmxnor0200h_firmware | No range specified | — |
| schneider-electric 140noe77111_firmware | No range specified | — |
| schneider-electric 140noc78000_firmware | No range specified | — |
| schneider-electric tsxety5103_firmware | No range specified | — |
| schneider-electric tsxety4103_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.