CVE-2020-7562

mediumPriorität · verfolgen · 32EPSS 0.009 · 60. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.91% (60th) EPSS

CVSS 5.8 · medium

Is it mine?

56 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationM340 CPUs BMX P34xcisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOC 0401cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0100 (H)cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0110 (H)cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOR 0200Hcisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium communication modulescisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC77101cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC78x00cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOE771x1cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum processors with integrated Ethernet COPRO 140CPU65xxxxxcisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.1

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 5.8–8.1

v2.05.8mediumAV:N/AC:M/Au:N/C:P/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 8.6 · Auswirkung 4.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.2

v3.06.3mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:Hsecondary · CISA US

v3.18.1highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:Hsecondary · ENISA EU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:HsecondaryAusnutzbarkeit 2.1 · Auswirkung 4.2

v3.17.4highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-125USCWE-125USCWE-125US

betroffene Produkte (56)

Betroffene Produkte und Versionsbereiche.

M340 CPUs BMX P34x: all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOC 0401: all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOE 0100 (H): all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOE 0110 (H): all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOR 0200H: all versionsalle Versionencisa_csaf_otUS
Premium communication modules: TSXETY4103 all versionsalle Versionencisa_csaf_otUS
Premium communication modules: TSXETY5103 all versionsalle Versionencisa_csaf_otUS
Premium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634: all versionsalle Versionencisa_csaf_otUS
Quantum communication modules 140NOC77101: all versionsalle Versionencisa_csaf_otUS
Quantum communication modules 140NOC78x00: all versionsalle Versionencisa_csaf_otUS
Quantum communication modules 140NOE771x1: all versionsalle Versionencisa_csaf_otUS
Quantum processors with integrated Ethernet COPRO 140CPU65xxxxx: all versionsalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 CPUs BMX P34xalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOC 0401alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOE 0100 (H)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOE 0110 (H)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOR 0200Halle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Premium communication modulesalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Premium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Quantum communication modules 140NOC77101alle Versionencisa_csaf_otUS

20 von 56 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-21-005-01Schneider Electric Web Server on Modicon M3402021-01-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow write access and the execution of commands, which could result in data corruption or a web server crash.

auch bekannt als (5)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2020-11-18geändert 2026-06-17

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan