High severity · published Dec 11, 2020
CVE-2020-7536
A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34* versions prior to V3.30) Modicon M340 Communication Ethernet…
7.5
CVSS
1.2%
EPSS
No
On KEV
Description
A CWE-754:Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M340 CPUs (BMXP34* versions prior to V3.30) Modicon M340 Communication Ethernet modules (BMXNOE0100 (H) versions prior to V3.4 BMXNOE0110 (H) versions prior to V6.6 BMXNOR0200H all versions), that could cause the device to be unreachable when modifying network parameters over SNMP.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 67% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BF
Bmxnoe0100 Firmware · Schneider-electric
before 3.4 · source: NVD
BF
Bmxnoe0110 Firmware · Schneider-electric
before 6.6 · source: NVD
BF
Bmxnor0200h Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Bmxp341000 Firmware · Schneider-electric
before 3.30 · source: NVD
MM
Modicon M340 Bmxp342000 Firmware · Schneider-electric
before 3.30 · source: NVD
MM
Modicon M340 Bmxp3420102 Firmware · Schneider-electric
before 3.30 · source: NVD
MM
Modicon M340 Bmxp3420102cl Firmware · Schneider-electric
before 3.30 · source: NVD
MM
Modicon M340 Bmxp342020 Firmware · Schneider-electric
before 3.30 · source: NVD
MM
Modicon M340 Bmxp3420302 Firmware · Schneider-electric
before 3.30 · source: NVD
MM
Modicon M340 Bmxp3420302cl Firmware · Schneider-electric
before 3.30 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7536
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7536
Vendor Advisory
https://security.cse.iitk.ac.in/responsible-disclosure
Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-343-07/
More from Bmxnoe0100 Firmware
9.8
CVE-2020-7540
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated…
9.8
CVE-2020-7533
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP…
7.5
CVE-2021-22788
A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP request to the web server of the device
7.5
CVE-2021-22787
A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server…
7.5
CVE-2021-22785
A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP…