CVE-2020-7564 HIGH

Published: 2020-11-18 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.

Additional Descriptions (1)

CWE-120: Una vulnerabilidad de Copia de búfer sin Comprobar el Tamaño de la Entrada ("Classic Buffer Overflow") se presenta en el Servidor Web de unas ofertas de Modicon M340, Modicon Quantum y Modicon Premium Legacy y sus Módulos de Comunicación (véase la notificación para más detalles) que podría causar acceso de escritura y una ejecución de comandos al cargar un archivo especialmente diseñado en el controlador por medio de FTP

CVSS Metrics

Base Score: 8.8 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	LOW
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 2.8

Impact Score: 5.9

Base Score: 6.5 (MEDIUM)

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	SINGLE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.0

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-120

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	modicon_tsxety4103_firmware	*	<built-in method update of dict object at 0x7e60eb225240>	Operating System
schneider-electric	modicon_tsxety5103_firmware	*	<built-in method update of dict object at 0x7e60a88afe80>	Operating System
schneider-electric	modicon_tsxp574634_firmware	*	<built-in method update of dict object at 0x7e60a88ade40>	Operating System
schneider-electric	modicon_tsxp575634_firmware	*	<built-in method update of dict object at 0x7e60a88ade00>	Operating System
schneider-electric	modicon_tsxp576634_firmware	*	<built-in method update of dict object at 0x7e60eb227600>	Operating System
schneider-electric	modicon_quantum_140noe77101_firmware	*	<built-in method update of dict object at 0x7e60eb225fc0>	Operating System
schneider-electric	modicon_quantum_140noe77111_firmware	*	<built-in method update of dict object at 0x7e60a88ad2c0>	Operating System
schneider-electric	modicon_quantum_140noc78100_firmware	*	<built-in method update of dict object at 0x7e60a88add40>	Operating System
schneider-electric	modicon_quantum_140cpu65150_firmware	*	<built-in method update of dict object at 0x7e60e8c7c980>	Operating System
schneider-electric	modicon_quantum_140cpu65150c_firmware	*	<built-in method update of dict object at 0x7e60eb224540>	Operating System
schneider-electric	modicon_quantum_140cpu65160c_firmware	*	<built-in method update of dict object at 0x7e6108405c00>	Operating System
schneider-electric	modicon_quantum_140cpu65160_firmware	*	<built-in method update of dict object at 0x7e6112cb5900>	Operating System
schneider-electric	modicon_m340_bmx_p34-2010_firmware	*	<built-in method update of dict object at 0x7e60eb224a00>	Operating System
schneider-electric	modicon_m340_bmx_p34-2030_firmware	*	<built-in method update of dict object at 0x7e6108406a00>	Operating System
schneider-electric	modicon_m340_bmx_noc_0401_firmware	*	<built-in method update of dict object at 0x7e6112cb4580>	Operating System
schneider-electric	modicon_m340_bmx_noe_0100_firmware	*	<built-in method update of dict object at 0x7e60eb225580>	Operating System
schneider-electric	modicon_m340_bmx_noe_0100h_firmware	*	<built-in method update of dict object at 0x7e60e8c7f640>	Operating System
schneider-electric	modicon_m340_bmx_noe_0110_firmware	*	<built-in method update of dict object at 0x7e60a88aee80>	Operating System
schneider-electric	modicon_m340_bmx_noe_0110h_firmware	*	<built-in method update of dict object at 0x7e6108404380>	Operating System
schneider-electric	modicon_m340_bmx_nor_0200h_firmware	*	<built-in method update of dict object at 0x7e60a88afcc0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxety4103_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxety4103:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxety5103_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxety5103:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxp574634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxp574634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxp575634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxp575634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_tsxp576634_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_tsxp576634:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140noe77101_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140noe77101:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140noe77111_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140noe77111:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140noc78100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140noc78100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65150_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65150:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65150c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65150c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65160c_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65160c:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_quantum_140cpu65160_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_quantum_140cpu65160:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_p34-2010_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_p34-2010:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_p34-2030_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_p34-2030:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noc_0401_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noc_0401:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0100_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0100:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0100h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0100h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0110_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0110:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_noe_0110h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_noe_0110h:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:modicon_m340_bmx_nor_0200h_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:modicon_m340_bmx_nor_0200h:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-01/
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory