PT-2020-6343 · Schneider Electric · Modicon M241+3

Published 2020-04-14 · Updated 2022-02-03 · CVE-2020-7487

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Modicon M218, M241, M251, and M258 (affected versions not specified)

Description The issue is related to insufficient verification of data authenticity, which could allow a remote attacker to execute arbitrary code on the affected controllers. This is a result of inadequate checking of data authenticity, potentially leading to malicious code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2021-04255

CVE-2020-7487

Affected Products

Modicon M218

Modicon M241

Modicon M251

Modicon M258

References · 6

• https://bdu.fstec.ru/vul/2021-04255 · Security Note
• https://se.com/ww/en/download/document/SEVD-2020-105-02 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7487 · Security Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-105-02_Modicon+M218_M241_M251_M258_M258_Logic_Controllers_SoMachine_SoMachine_Motion_EcoStruxure_Machine_Expert_Security_Notification_V1.1.pdf&p_Doc_Ref=SEVD-2020-105-02 · Note
• https://t.me/cvenotify/3056 · Telegram Post
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-105-02_Modicon+M218_M241_M251_M258_M258_Logic_Controllers_SoMachine_SoMachine_Motion_EcoStruxure_Machine_Expert_Security_Notification_V1.1.pdf&p_Doc_Ref=SEVD-2020-105-02 · Note