Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-7540

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause unauthenticated command execution in the controller when sending special HTTP requests.

Published

2020-12-11T01:15:12.377

Last Modified

2024-11-21T05:37:20.573

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-306
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System schneider-electric modicon_m340_bmxp341000_firmware < 3.30 Yes
Hardware schneider-electric modicon_m340_bmxp341000 - No
Operating System schneider-electric modicon_m340_bmxp342000_firmware < 3.30 Yes
Hardware schneider-electric modicon_m340_bmxp342000 - No
Operating System schneider-electric modicon_m340_bmxp3420102_firmware < 3.30 Yes
Hardware schneider-electric modicon_m340_bmxp3420102 - No
Operating System schneider-electric modicon_m340_bmxp3420102cl_firmware < 3.30 Yes
Hardware schneider-electric modicon_m340_bmxp3420102cl - No
Operating System schneider-electric modicon_m340_bmxp342020_firmware < 3.30 Yes
Hardware schneider-electric modicon_m340_bmxp342020 - No
Operating System schneider-electric modicon_m340_bmxp3420302_firmware < 3.30 Yes
Hardware schneider-electric modicon_m340_bmxp3420302 - No
Operating System schneider-electric modicon_m340_bmxp3420302cl_firmware < 3.30 Yes
Hardware schneider-electric modicon_m340_bmxp3420302cl - No
Operating System schneider-electric bmxnoe0100_firmware < 3.3 Yes
Hardware schneider-electric bmxnoe0100 - No
Operating System schneider-electric bmxnoe0110_firmware < 6.5 Yes
Hardware schneider-electric bmxnoe0110 - No
Operating System schneider-electric 140noe77101_firmware < 7.1 Yes
Hardware schneider-electric 140noe77101 - No
Operating System schneider-electric 140noe77111_firmware < 7.1 Yes
Hardware schneider-electric 140noe77111 - No
Operating System schneider-electric 140cpu65150_firmware < 6.1 Yes
Hardware schneider-electric 140cpu65150 - No
Operating System schneider-electric 140cpu65160_firmware < 6.1 Yes
Hardware schneider-electric 140cpu65160 - No
Operating System schneider-electric 140noc78000_firmware < 1.74 Yes
Hardware schneider-electric 140noc78000 - No
Operating System schneider-electric 140noc78100_firmware < 1.74 Yes
Hardware schneider-electric 140noc78100 - No
Operating System schneider-electric 140noc77101_firmware < 1.08 Yes
Hardware schneider-electric 140noc77101 - No
Operating System schneider-electric tsxp574634_firmware < 6.1 Yes
Hardware schneider-electric tsxp574634 - No
Operating System schneider-electric tsxp575634_firmware < 6.1 Yes
Hardware schneider-electric tsxp575634 - No
Operating System schneider-electric tsxp576634_firmware < 6.1 Yes
Hardware schneider-electric tsxp576634 - No
Operating System schneider-electric tsxety4103_firmware < 6.2 Yes
Hardware schneider-electric tsxety4103 - No
Operating System schneider-electric tsxety5103_firmware < 6.4 Yes
Hardware schneider-electric tsxety5103 - No
Operating System schneider-electric bmxnoc0401_firmware < 2.10 Yes
Hardware schneider-electric bmxnoc0401 - No
Operating System schneider-electric bmxnor200h_firmware * Yes
Hardware schneider-electric bmxnor200h - No
References