CRITICAL🇵🇱 Wersja polska

CVE-2020-7475

CVSS 9.8v3.1pub. 2020-03-23upd. 2024-11-21

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Schneider Electric Ecostruxure Control Expert

    APP
    Schneider-Electric
    ≤ 14.0

  • Schneider Electric Modicon M340

    HW
    Schneider-Electric
    all versions

  • Schneider Electric Modicon M340 Firmware

    OS
    Schneider-Electric
    < 3.20

  • Schneider Electric Modicon M580

    HW
    Schneider-Electric
    all versions

  • Schneider Electric Modicon M580 Firmware

    OS
    Schneider-Electric
    < 3.10

  • Schneider Electric Unity Pro

    APP
    Schneider-Electric
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2022-37300CRITICAL9.8PL ✓same product

Słaby mechanizm odzyskiwania hasła w produktach Schneider Electric — dostęp przez Modbus

CVE-2022-26507CRITICAL9.8PL ✓same product

Heap-based buffer overflow w AT&T Xmill — możliwe zdalne wykonanie kodu

CVE-2021-22779CRITICAL9.1PL ✓same product

Authentication Bypass w produktach Schneider Electric via Modbus Spoofing

CVE-2020-28212CRITICAL9.8PL ✓same product

Brak limitu prób uwierzytelnienia w PLC Simulator EcoStruxure Control Expert

CVE-2018-7847CRITICAL9.8PL ✓same product

Nieprawidłowa kontrola dostępu w sterownikach Schneider Electric Modicon via Modbus