CVE-2020-7498 — CRITICAL (9.8)

Vulnerability Description

A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Schneider-Electric	Os Loader	All versions
Schneider-Electric	Unity Loader	All versions

Related Weaknesses (CWE)

CWE-798

References

https://www.se.com/ww/en/download/document/SEVD-2020-161-02Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-161-02Vendor Advisory

FAQ

What is CVE-2020-7498?

CVE-2020-7498 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixe...

How severe is CVE-2020-7498?

CVE-2020-7498 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-7498?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Os Loader, Schneider-Electric Unity Loader.