CVE-2020-7533

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

Score

CVSS 3.1 9.8 Critical

Status

Modified - cybersecurity@se.com

Published

2020-12-01

Last modified

2025-06-10

Weaknesses

CWE-287

Affected products

• 140cpu65260 Firmware (Schneider-electric)
• 140noc77101 Firmware (Schneider-electric)
• 140noc78000 Firmware (Schneider-electric)
• 140noe77111 Firmware (Schneider-electric)
• Bmxnoc0401 Firmware (Schneider-electric)
• Bmxnoe0100 Firmware (Schneider-electric)
• Bmxnoe0110 Firmware (Schneider-electric)
• Modicon M340 Bmxp341000 Firmware (Schneider-electric)
• Modicon M340 Bmxp342000 Firmware (Schneider-electric)
• Modicon M340 Bmxp3420102 Firmware (Schneider-electric)
• Modicon M340 Bmxp3420302 Firmware (Schneider-electric)
• Tsxety4103 Firmware (Schneider-electric)
• Tsxety5103 Firmware (Schneider-electric)
• Tsxp574634 Firmware (Schneider-electric)
• Tsxp575634 Firmware (Schneider-electric)
• Tsxp576634 Firmware (Schneider-electric)

References

• https://download.schneider-electric.com/files?p_File_Name=SEVD-2020-287-01_Modicon_Web_Server_Security_Notificatiton.pd…
• https://www.se.com/ww/en/download/document/SEVD-2020-287-01/