CVE-2020-7533 : A CWE-255: Credentials Management vulnerability exists in Web Server on Modicon

A CWE-255: Credentials Management vulnerability exists in Web Server on Modicon M340, Modicon Quantum and ModiconPremium Legacy offers and their Communication Modules (see security notification for version information) which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

Published 2020-12-01 15:15:12

Updated 2022-04-25 17:45:40

Source Schneider Electric SE

View at NVD, CVE.org

Products affected by CVE-2020-7533

Schneider-electric » 140cpu65260 Firmware
Versions before (<) 6.1
cpe:2.3:o:schneider-electric:140cpu65260_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140cpu65260 » Version: N/A
Schneider-electric » Bmxp341000 Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:bmxp341000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Bmxp341000 » Version: N/A
Schneider-electric » Bmxp342000 Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:bmxp342000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Bmxp342000 » Version: N/A
Schneider-electric » Bmxp3420102 Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:bmxp3420102_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Bmxp3420102 » Version: N/A
Schneider-electric » Bmxp3420302 Firmware
Versions before (<) 3.20
cpe:2.3:o:schneider-electric:bmxp3420302_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Bmxp3420302 » Version: N/A
Schneider-electric » Bmxnoc0401 Firmware
Versions before (<) 2.10
cpe:2.3:o:schneider-electric:bmxnoc0401_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Bmxnoc0401 » Version: N/A
Schneider-electric » Bmxnoe0100 Firmware
Versions before (<) 3.3
cpe:2.3:o:schneider-electric:bmxnoe0100_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Bmxnoe0100 » Version: N/A
Schneider-electric » Bmxnoe0110 Firmware
Versions before (<) 6.5
cpe:2.3:o:schneider-electric:bmxnoe0110_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Bmxnoe0110 » Version: N/A
Schneider-electric » 140noe77111 Firmware
Versions before (<) 7.1
cpe:2.3:o:schneider-electric:140noe77111_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140noe77111 » Version: N/A
Schneider-electric » Tsxp574634 Firmware
Versions before (<) 6.1
cpe:2.3:o:schneider-electric:tsxp574634_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp574634 » Version: N/A
Schneider-electric » Tsxp575634 Firmware
Versions before (<) 6.1
cpe:2.3:o:schneider-electric:tsxp575634_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp575634 » Version: N/A
Schneider-electric » Tsxp576634 Firmware
Versions before (<) 6.1
cpe:2.3:o:schneider-electric:tsxp576634_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxp576634 » Version: N/A
Schneider-electric » Tsxety4103 Firmware
Versions before (<) 6.2
cpe:2.3:o:schneider-electric:tsxety4103_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxety4103 » Version: N/A
Schneider-electric » Tsxety5103 Firmware
Versions before (<) 6.4
cpe:2.3:o:schneider-electric:tsxety5103_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » Tsxety5103 » Version: N/A
Schneider-electric » 140noc78000 Firmware
Versions before (<) 1.74
cpe:2.3:o:schneider-electric:140noc78000_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140noc78000 » Version: N/A
Schneider-electric » 140noc77101 Firmware
Versions before (<) 1.08
cpe:2.3:o:schneider-electric:140noc77101_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Schneider-electric » 140noc77101 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-7533

EPSS FAQ

0.23%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 61 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-7533

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-7533

CWE-255

Assigned by: cybersecurity@se.com (Secondary)

References for CVE-2020-7533

https://www.se.com/ww/en/download/document/SEVD-2020-287-01/

Security Notification - Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules | Schneider Electric
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-7533

Products affected by CVE-2020-7533

Exploit prediction scoring system (EPSS) score for CVE-2020-7533

CVSS scores for CVE-2020-7533

CWE ids for CVE-2020-7533

References for CVE-2020-7533