CVE-2020-7541

Published: Dec 11, 2020Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause disclosure of sensitive data when sending a specially crafted request to the controller over HTTP.

Affected (20)

Products: Schneider Electric: Modicon M340 Bmxp341000 Firmware, Modicon M340 Bmxp342000 Firmware, Modicon M340 Bmxp3420102 Firmware, Modicon M340 Bmxp3420102cl Firmware, Modicon M340 Bmxp342020 Firmware, Modicon M340 Bmxp3420302 Firmware, Modicon M340 Bmxp3420302cl Firmware, Bmxnoe0100 Firmware, Bmxnoe0110 Firmware, Bmxnoc0401 Firmware, Tsxp574634 Firmware, Tsxp575634 Firmware, Tsxp576634 Firmware, Tsxety4103 Firmware, Tsxety5103 Firmware, 140cpu65150 Firmware, 140noe77111 Firmware, 140noc78100 Firmware, 140noc78000 Firmware, 140noc77101 Firmware

Schneider Electric

20 products

Modicon M340 Bmxp341000 Firmware

Modicon M340 Bmxp342000 Firmware

Modicon M340 Bmxp3420102 Firmware

Modicon M340 Bmxp3420102cl Firmware

Modicon M340 Bmxp342020 Firmware

Modicon M340 Bmxp3420302 Firmware

Modicon M340 Bmxp3420302cl Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp341000 Firmware	Before 3.30

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp341000	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342000 Firmware	Before 3.30

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342000	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420102 Firmware	Before 3.30

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420102	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420102cl Firmware	Before 3.30

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420102cl	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp342020 Firmware	Before 3.30

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp342020	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420302 Firmware	Before 3.30

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420302	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M340 Bmxp3420302cl Firmware	Before 3.30

Running on/with	Platform Versions
Schneider Electric Modicon M340 Bmxp3420302cl	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoe0100 Firmware	Before 3.3

Running on/with	Platform Versions
Schneider Electric Bmxnoe0100	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoe0110 Firmware	Before 6.5

Running on/with	Platform Versions
Schneider Electric Bmxnoe0110	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Bmxnoc0401 Firmware	Before 2.10

Running on/with	Platform Versions
Schneider Electric Bmxnoc0401	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp574634 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric Tsxp574634	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp575634 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric Tsxp575634	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxp576634 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric Tsxp576634	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxety4103 Firmware	Before 6.2

Running on/with	Platform Versions
Schneider Electric Tsxety4103	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Tsxety5103 Firmware	Before 6.4

Running on/with	Platform Versions
Schneider Electric Tsxety5103	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140cpu65150 Firmware	Before 6.1

Running on/with	Platform Versions
Schneider Electric 140cpu65150	All versions

Configuration Q

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noe77111 Firmware	Before 7.1

Running on/with	Platform Versions
Schneider Electric 140noe77111	All versions

Configuration R

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noc78100 Firmware	Before 1.74

Running on/with	Platform Versions
Schneider Electric 140noc78100	All versions

Configuration S

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noc78000 Firmware	Before 1.74

Running on/with	Platform Versions
Schneider Electric 140noc78000	All versions

Configuration T

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric 140noc77101 Firmware	Before 1.08

Running on/with	Platform Versions
Schneider Electric 140noc77101	All versions

Related CWEs

CWE-425

Direct Request ('Forced Browsing')

The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.

References (2)

https://www.se.com/ww/en/download/document/SEVD-2020-343-03/

Source: cybersecurity@se.com

Vendor Advisory

https://www.se.com/ww/en/download/document/SEVD-2020-343-03/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.