CVE-2020-7562
High
Description
A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP.
SeverityHigh
CVSS8.1
Exploit probability—
ProductSchneider-electric Modicon Tsxety4103 Firmware
PublishedNov 18, 2020
First seenNov 18, 2020
Weakness typeCWE-125Out-of-bounds read
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicon_tsxety4103_firmware | No range specified | — |
| schneider-electric modicon_tsxety5103_firmware | No range specified | — |
| schneider-electric modicon_tsxp574634_firmware | No range specified | — |
| schneider-electric modicon_tsxp575634_firmware | No range specified | — |
| schneider-electric modicon_tsxp576634_firmware | No range specified | — |
| schneider-electric modicon_quantum_140noe77101_firmware | No range specified | — |
| schneider-electric modicon_quantum_140noe77111_firmware | No range specified | — |
| schneider-electric modicon_quantum_140noc78100_firmware | No range specified | — |
| schneider-electric modicon_quantum_140cpu65150_firmware | No range specified | — |
| schneider-electric modicon_quantum_140cpu65150c_firmware | No range specified | — |
| schneider-electric modicon_quantum_140cpu65160c_firmware | No range specified | — |
| schneider-electric modicon_quantum_140cpu65160_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_p34-2010_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_p34-2030_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_noc_0401_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_noe_0100_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_noe_0100h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_noe_0110_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_noe_0110h_firmware | No range specified | — |
| schneider-electric modicon_m340_bmx_nor_0200h_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.