CVE-2020-7563 HIGH

Published: 2020-11-18 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.

Additional Descriptions (1)

CWE-787: Una vulnerabilidad de escritura fuera de límites se presenta en el Servidor Web de unas ofertas de Modicon M340, Modicon Quantum y Modicon Premium Legacy y sus Módulos de Comunicación (véase la notificación para más detalles) que podría causar una corrupción de datos, un bloqueo o una ejecución de código al cargar un archivo especialmente diseñado en el controlador por medio de FTP

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 5.9

Base Score: 6.5 (MEDIUM)

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	SINGLE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-787

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_tsxety4103_firmware	*	<built-in method update of dict object at 0x7e60bb917980>	Operating System
schneider-electric	modicon_tsxety5103_firmware	*	<built-in method update of dict object at 0x7e60bb917440>	Operating System
schneider-electric	modicon_tsxp574634_firmware	*	<built-in method update of dict object at 0x7e6110a57b40>	Operating System
schneider-electric	modicon_tsxp575634_firmware	*	<built-in method update of dict object at 0x7e6110a57e80>	Operating System
schneider-electric	modicon_tsxp576634_firmware	*	<built-in method update of dict object at 0x7e60bb916640>	Operating System
schneider-electric	modicon_quantum_140noe77101_firmware	*	<built-in method update of dict object at 0x7e60bb914f00>	Operating System
schneider-electric	modicon_quantum_140noe77111_firmware	*	<built-in method update of dict object at 0x7e60bb917800>	Operating System
schneider-electric	modicon_quantum_140noc78100_firmware	*	<built-in method update of dict object at 0x7e60e846fc80>	Operating System
schneider-electric	modicon_quantum_140cpu65150_firmware	*	<built-in method update of dict object at 0x7e60bb916a00>	Operating System
schneider-electric	modicon_quantum_140cpu65150c_firmware	*	<built-in method update of dict object at 0x7e60bb916400>	Operating System
schneider-electric	modicon_quantum_140cpu65160c_firmware	*	<built-in method update of dict object at 0x7e6110a54e80>	Operating System
schneider-electric	modicon_quantum_140cpu65160_firmware	*	<built-in method update of dict object at 0x7e60bb917f40>	Operating System
schneider-electric	modicon_m340_bmx_p34-2010_firmware	*	<built-in method update of dict object at 0x7e6110a56a80>	Operating System
schneider-electric	modicon_m340_bmx_p34-2030_firmware	*	<built-in method update of dict object at 0x7e60eb226600>	Operating System
schneider-electric	modicon_m340_bmx_noc_0401_firmware	*	<built-in method update of dict object at 0x7e6110a56580>	Operating System
schneider-electric	modicon_m340_bmx_noe_0100_firmware	*	<built-in method update of dict object at 0x7e60e846dc80>	Operating System
schneider-electric	modicon_m340_bmx_noe_0100h_firmware	*	<built-in method update of dict object at 0x7e60bb916f00>	Operating System
schneider-electric	modicon_m340_bmx_noe_0110_firmware	*	<built-in method update of dict object at 0x7e60bb916e40>	Operating System
schneider-electric	modicon_m340_bmx_noe_0110h_firmware	*	<built-in method update of dict object at 0x7e60eb224a00>	Operating System
schneider-electric	modicon_m340_bmx_nor_0200h_firmware	*	<built-in method update of dict object at 0x7e6110a56e80>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxety4103_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxety4103:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxety5103_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxety5103:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxp574634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxp574634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxp575634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxp575634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxp576634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxp576634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140noe77101_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140noe77101:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140noe77111_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140noe77111:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140noc78100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140noc78100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65150c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65150c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65160c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65160c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65160_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65160:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_p34-2010_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_p34-2010:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_p34-2030_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_p34-2030:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noc_0401_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noc_0401:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0100h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0100h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0110_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0110:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0110h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0110h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_nor_0200h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_nor_0200h:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory