CVE-2020-7564

mediumPriorität · verfolgen · 35EPSS 0.012 · 67. PerzentilEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

1.18% (67th) EPSS

CVSS 6.5 · medium

Is it mine?

57 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

MitigationM340 CPUs BMX P34xcisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOC 0401cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0100 (H)cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOE 0110 (H)cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationM340 Communication Ethernet modules BMX NOR 0200Hcisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium communication modulescisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationPremium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC77101cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOC78x00cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum communication modules 140NOE771x1cisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.
MitigationQuantum processors with integrated Ethernet COPRO 140CPU65xxxxxcisa_csaf_ot
Configure the access control list via Ecostruxure Control Expert programming tool.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.3–8.8

v2.06.5mediumAV:N/AC:L/Au:S/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 8 · Auswirkung 6.4

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 2.8 · Auswirkung 5.9

v3.06.3mediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:Hsecondary · CISA US

v3.18.8highAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:Hsecondary · ENISA EU

v3.16.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:HsecondaryAusnutzbarkeit 2.1 · Auswirkung 4.2

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-120USCWE-120USCWE-120US

betroffene Produkte (57)

Betroffene Produkte und Versionsbereiche.

M340 CPUs BMX P34x: all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOC 0401: all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOE 0100 (H): all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOE 0110 (H): all versionsalle Versionencisa_csaf_otUS
M340 Communication Ethernet modules BMX NOR 0200H: all versionsalle Versionencisa_csaf_otUS
Premium communication modules: TSXETY4103 all versionsalle Versionencisa_csaf_otUS
Premium communication modules: TSXETY5103 all versionsalle Versionencisa_csaf_otUS
Premium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634: all versionsalle Versionencisa_csaf_otUS
Quantum communication modules 140NOC77101: all versionsalle Versionencisa_csaf_otUS
Quantum communication modules 140NOC78x00: all versionsalle Versionencisa_csaf_otUS
Quantum communication modules 140NOE771x1: all versionsalle Versionencisa_csaf_otUS
Quantum processors with integrated Ethernet COPRO 140CPU65xxxxx: all versionsalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 CPUs BMX P34xalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOC 0401alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOE 0100 (H)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOE 0110 (H)alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC M340 Communication Ethernet modules BMX NOR 0200Halle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Premium communication modulesalle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Premium processors with integrated Ethernet COPRO TSXP574634 TSXP575634 TSXP576634alle Versionencisa_csaf_otUS
Schneider Electric Software, LLC Quantum communication modules 140NOC77101alle Versionencisa_csaf_otUS

20 von 57 angezeigt

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

ICSA-21-005-01Schneider Electric Web Server on Modicon M3402021-01-05icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities may allow write access and the execution of commands, which could result in data corruption or a web server crash.

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd fstec_bdu cisa_csaf_ot NVD CVE.org MITRE

veröffentlicht 2020-11-18geändert 2026-06-17

Referenzen (6)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan