PT-2020-6330 · Schneider Electric · Modicon M340+2

Published 2020-12-08 · Updated 2024-04-10 · CVE-2020-7535

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Modicon M340, Modicon Quantum, Modicon Premium (affected versions not specified)

Description The issue is related to improper limitation of a pathname to a restricted directory, which could allow a remote attacker to gain unauthorized access to protected information by sending a specially crafted HTTP request. This is a path traversal vulnerability type.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-04191

CVE-2020-7535

Affected Products

Modicon M340

Modicon Premium

Modicon Quantum

References · 30

• https://bdu.fstec.ru/vul/2021-04191 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-7535 · Security Note
• https://se.com/ww/en/download/document/SEVD-2020-343-05 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7535 · Vendor Advisory
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-343-05_Web_Server_Modicon_M340_Premium_Quantum_Communication_Modules_Security_Notification_V2.0.pdf&p_Doc_Ref=SEVD-2020-343-05 · Note
• https://t.me/cibsecurity/19841 · Telegram Post
• https://t.me/cibsecurity/20228 · Telegram Post
• https://t.me/cibsecurity/20189 · Telegram Post
• https://t.me/cibsecurity/20075 · Telegram Post
• https://t.me/cibsecurity/19997 · Telegram Post
• https://t.me/cibsecurity/19881 · Telegram Post
• https://t.me/cibsecurity/20113 · Telegram Post
• https://t.me/cibsecurity/20017 · Telegram Post
• https://t.me/cibsecurity/19801 · Telegram Post
• https://t.me/cibsecurity/19821 · Telegram Post