High severity · published Nov 18, 2020
CVE-2020-7562
A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see…
8.1
CVSS
0.9%
EPSS
No
On KEV
Description
A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WS
Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) ·
Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) · source: vendor
MM
Modicon M340 Bmx Noc 0401 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmx Noe 0100 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmx Noe 0100h Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmx Noe 0110 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmx Noe 0110h Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmx Nor 0200h Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmx P34-2010 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmx P34-2030 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MQ
Modicon Quantum 140cpu65150 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MQ
Modicon Quantum 140cpu65150c Firmware · Schneider-electric
All versions, or not specified · source: NVD
MQ
Modicon Quantum 140cpu65160 Firmware · Schneider-electric
All versions, or not specified · source: NVD
Affected product
WS
Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details)
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7562
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7562
Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
More from Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details)
8.8
CVE-2020-7564
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium…
8.8
CVE-2020-7563
A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see…