1. Home
  2. CVE Database
  3. CVE-2020-7540
CRITICAL · 9.8

CVE-2020-7540

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (...

Vulnerability Description

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause unauthenticated command execution in the controller when sending special HTTP requests.

CVSS Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Schneider-ElectricModicon M340 Bmxp341000 Firmware< 3.30
Schneider-ElectricModicon M340 Bmxp341000-
Schneider-ElectricModicon M340 Bmxp342000 Firmware< 3.30
Schneider-ElectricModicon M340 Bmxp342000-
Schneider-ElectricModicon M340 Bmxp3420102 Firmware< 3.30
Schneider-ElectricModicon M340 Bmxp3420102-
Schneider-ElectricModicon M340 Bmxp3420102Cl Firmware< 3.30
Schneider-ElectricModicon M340 Bmxp3420102Cl-
Schneider-ElectricModicon M340 Bmxp342020 Firmware< 3.30
Schneider-ElectricModicon M340 Bmxp342020-
Schneider-ElectricModicon M340 Bmxp3420302 Firmware< 3.30
Schneider-ElectricModicon M340 Bmxp3420302-
Schneider-ElectricModicon M340 Bmxp3420302Cl Firmware< 3.30
Schneider-ElectricModicon M340 Bmxp3420302Cl-
Schneider-ElectricBmxnoe0100 Firmware< 3.3
Schneider-ElectricBmxnoe0100-
Schneider-ElectricBmxnoe0110 Firmware< 6.5
Schneider-ElectricBmxnoe0110-
Schneider-Electric140Noe77101 Firmware< 7.1
Schneider-Electric140Noe77101-

Related Weaknesses (CWE)

CWE-306

References

FAQ

What is CVE-2020-7540?

CVE-2020-7540 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (...

How severe is CVE-2020-7540?

CVE-2020-7540 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.

Is there a patch for CVE-2020-7540?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Modicon M340 Bmxp341000 Firmware, Schneider-Electric Modicon M340 Bmxp341000, Schneider-Electric Modicon M340 Bmxp342000 Firmware, Schneider-Electric Modicon M340 Bmxp342000, Schneider-Electric Modicon M340 Bmxp3420102 Firmware.