ICSA-21-005-01

Schneider Electric Web Server on Modicon M340

view advisory published 2021-01-05

Successful exploitation of these vulnerabilities may allow write access and the execution of commands, which could result in data corruption or a web server crash.

describes (3)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2020-7564US	high8.8	1.18% (67th)	—	2020-11-18
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy…
CVE-2020-7563US	high8.8	1.13% (66th)	—	2020-11-18
A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notifi…
CVE-2020-7562US	high8.1	0.91% (60th)	—	2020-11-18
A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notific…

references

External citations — patches, advisories, analysis.

ICS Advisory ICSA-21-005-01 JSONself
Recommended Practicesexternal
Recommended Practicesexternal
Recommended Practicesexternal
ICS Advisory ICSA-21-005-01 Web Versionself

remediations (33)

MitigationM340 CPUs BMX P34x
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 CPUs BMX P34x
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 CPUs BMX P34x
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOC 0401
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOC 0401
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOC 0401
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0100 (H)
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0100 (H)
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0100 (H)
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0110 (H)
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0110 (H)
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0110 (H)
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOR 0200H
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOR 0200H
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOR 0200H
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium communication modules
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium communication modules
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium communication modules
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC77101
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC77101
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC77101
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC78x00
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC78x00
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC78x00
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOE771x1
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOE771x1
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOE771x1
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum processors with integrated Ethernet COPRO 140CPU65xxxxx
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum processors with integrated Ethernet COPRO 140CPU65xxxxx
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum processors with integrated Ethernet COPRO 140CPU65xxxxx
Configure the access control list via Ecostruxure Control Expert programming tool.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan