CVE-2020-7533

Published: Dec 1, 2020Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

Affected (16)

Products: Schneider Electric: Modicon M340 Bmxp342000 Firmware, Modicon M340 Bmxp341000 Firmware, Modicon M340 Bmxp3420102 Firmware, Modicon M340 Bmxp3420302 Firmware, Bmxnoe0100 Firmware, Bmxnoe0110 Firmware, Bmxnoc0401 Firmware, Tsxp574634 Firmware, Tsxp575634 Firmware, Tsxp576634 Firmware, Tsxety4103 Firmware, Tsxety5103 Firmware, 140noe77111 Firmware, 140noc78000 Firmware, 140noc77101 Firmware, 140cpu65260 Firmware

Schneider Electric

16 products

Modicon M340 Bmxp342000 Firmware

Modicon M340 Bmxp341000 Firmware

Modicon M340 Bmxp3420102 Firmware

Modicon M340 Bmxp3420302 Firmware

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342000 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp341000 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp341000	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420102 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420102	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420302 Firmware	Before 3.20

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420302	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoe0100 Firmware	Before 3.3

Running on/with	Platform Versions
Schneider Electric Bmxnoe0100	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoe0110 Firmware	Before 6.5

Running on/with	Platform Versions
Schneider Electric Bmxnoe0110	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoc0401 Firmware	Before 2.10

Running on/with	Platform Versions
Schneider Electric Bmxnoc0401	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp574634 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric Tsxp574634	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp575634 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric Tsxp575634	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp576634 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric Tsxp576634	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxety4103 Firmware	Before 6.2

Running on/with	Platform Versions
Schneider Electric Tsxety4103	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxety5103 Firmware	Before 6.4

Running on/with	Platform Versions
Schneider Electric Tsxety5103	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noe77111 Firmware	Before 7.1

Running on/with	Platform Versions
Schneider Electric 140noe77111	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noc78000 Firmware	Before 1.74

Running on/with	Platform Versions
Schneider Electric 140noc78000	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noc77101 Firmware	Before 1.08

Running on/with	Platform Versions
Schneider Electric 140noc77101	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140cpu65260 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric 140cpu65260	All versions

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (2)

https://download.schneider-electric.com/files?p_File_Name=SEVD-2020-287-01_Modicon_Web_Server_Security_Notificatiton.pdf&p_Doc_Ref=SEVD-2020-287-01&p_enDocType=Security+and+Safety+Notice

Source: cybersecurity@se.com

https://www.se.com/ww/en/download/document/SEVD-2020-287-01/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.