// Description
Schneider Electric Security Notification
8-Dec-20 Document Reference Number – SEVD-2020 -343-08 Page 1 of 6
## Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium
8 December 2020
# Overview
Schneider Electric is aware of multiple vulnerabilities in its Modicon programmable automation controllers.
The Modicon Ethernet Programmable Automation products are controllers for industrial process and infrastructure.
Failure to apply the remediations provided below may risk a denial of service attack, which could result in making the device enter a non-recoverable fault state.
# Affected Products & Versions
Product and Affected Versions CVE
Modicon M580 CPUs –
BMEx58xxxxx prior to version 3.20
CVE-2020-7537, CVE-2020-7542,
CVE-2020-7543
Modicon M340 CPUs –
BMX P34x prior to version 3.30
CVE-2020-7537, CVE-2020-7542,
CVE-2020-7543
Modicon Premium CPUs all versions –
TSXP574634, TSXP575634, TSXP576634 CVE-2020-7537, CVE-2020-7542
Modicon Quantum CPUs all versions –
140CPU65xxxxx CVE-2020-7542
# Vulnerability Details
CVE ID: CVE-2020-7537
CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service when a specially crafted Read Physical Memory request over Modbus is sent to the controller. Schneider Electric Security Notification
8-Dec-20 Document Reference Number – SEVD-2020 -343-08 Page 2 of 6
CVE ID: CVE-2020-7542
CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when a specially crafted Read request over Modbus is send to the controller.
CVE ID: CVE-2020-7543
CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H