Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules

13-Oct-20 Document Reference Number – SEVD-2020 -287-01 (v1.1.0) # Schneider Electric Security Notification Page 1 of 5 > Public ## Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules 13 October 2020 # Overview Schneider Electric is aware of a vulnerability in the web server of the Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their communication modules. The Modicon Ethernet Programmable Automation products are controllers for industrial process and infrastructure. Failure to apply the remediations provided below may risk execution of commands on the webserver by an authenticated attacker, which could result in loss of availability, confidentiality and integrity on the controller. # Affected Products and Versions • M340 CPUs o BMX P34x prior to firmware version 3.20 • M340 Communication Ethernet modules o BMX NOE 0100 (H) prior to version 3.3 o BMX NOE 0110 (H) prior to version 6.5 o BMX NOC 0401 prior to version 2.10 • Premium processors with integrated Ethernet COPRO o TSXP574634, TSXP575634, TSXP576634 prior to 6.1 version • Premium communication modules o TSXETY4103 prior to version 6.2 o TSXETY5103 prior to version 6.4 • Quantum processors with integrated Ethernet COPRO o 140CPU65xxxxx prior to 6.1 version • Quantum communication modules o 140NOE771x1 prior to version 7.1 o 140NOC78x00 prior to version 1.74 o 140NOC77101 prior to version 1.08 13-Oct-20 Document Reference Number – SEVD-2020 -287-01 (v1.1.0) # Schneider Electric Security Notification Page 2 of 5 > Public # Vulnerability Details CVE ID: CVE-2020-7533 CVSS v3.0 Base Score 10.0 | Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests. # Remediation