CVE-2020-7533: CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP… | LiveThreat CVE Feed — Verisq

Login Request a demo

Critical severity · published Dec 1, 2020

CVE-2020-7533

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP…

9.8

CVSS

2.3%

EPSS

No

On KEV

Description

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.3% · higher than 83% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

1F

140cpu65260 Firmware · Schneider-electric

before 6.1 · source: NVD

1F

140noc77101 Firmware · Schneider-electric

before 1.08 · source: NVD

1F

140noc78000 Firmware · Schneider-electric

before 1.74 · source: NVD

1F

140noe77111 Firmware · Schneider-electric

before 7.1 · source: NVD

BF

Bmxnoc0401 Firmware · Schneider-electric

before 2.10 · source: NVD

BF

Bmxnoe0100 Firmware · Schneider-electric

before 3.3 · source: NVD

BF

Bmxnoe0110 Firmware · Schneider-electric

before 6.5 · source: NVD

MM

Modicon M340 Bmxp341000 Firmware · Schneider-electric

before 3.20 · source: NVD

MM

Modicon M340 Bmxp342000 Firmware · Schneider-electric

before 3.20 · source: NVD

MM

Modicon M340 Bmxp3420102 Firmware · Schneider-electric

before 3.20 · source: NVD

MM

Modicon M340 Bmxp3420302 Firmware · Schneider-electric

before 3.20; before 3.20 · source: NVD

TF

Tsxety4103 Firmware · Schneider-electric

before 6.2 · source: NVD

Affected product

1F

140cpu65260 Firmware

Schneider-electric

All 140cpu65260 Firmware CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2020-7533

https://www.cve.org/CVERecord?id=CVE-2020-7533

download.schneider-electric.com

https://download.schneider-electric.com/files?p_File_Name=SEVD-2020-287-01_Modicon_Web_Server_Security_Notificatiton.pdf&p_Doc_Ref=SEVD-2020-287-01&p_enDocType=Security+and+Safety+Notice

Vendor Advisory

https://www.se.com/ww/en/download/document/SEVD-2020-287-01/

More from 140cpu65260 Firmware

9.8

A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200 which could allow arbitrary code execution

9.8

An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC, BMXNOR0200

9.8

Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules

9.8

Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers in all versions of the communication modules

8.8

A vulnerability exists in Schneider Electric's Modicon Quantum in all versions of the communication modules which could allow arbitrary code execution