PT-2020-6371 · Schneider Electric · Modicon M340+2

Published 2020-12-08 · Updated 2024-04-10 · CVE-2020-7539

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Modicon M340, Modicon Quantum, Modicon Premium (affected versions not specified)

Description The issue is related to insufficient checking of unusual or exceptional conditions in the software of programmable logic controllers. This could allow a remote attacker to cause a denial of service when a specially crafted packet is sent to the controller over HTTP. The vulnerability exists in the Web Server on the affected devices and associated Communication Modules.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

BDU:2021-04326

CVE-2020-7539

Affected Products

Modicon M340

Modicon Premium

Modicon Quantum

References · 30

• https://se.com/ww/en/download/document/SEVD-2020-343-03 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-7539 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04326 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-7539 · Security Note
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2020-343-03_Web_Server_Modicon_M340_Premium_Quantum_Communication_Modules_Security_Notification_V2.0.pdf&p_Doc_Ref=SEVD-2020-343-03 · Note
• https://t.me/cibsecurity/19903 · Telegram Post
• https://t.me/cibsecurity/20019 · Telegram Post
• https://t.me/cibsecurity/20133 · Telegram Post
• https://t.me/cibsecurity/20038 · Telegram Post
• https://t.me/cibsecurity/19942 · Telegram Post
• https://t.me/cibsecurity/19863 · Telegram Post
• https://t.me/cibsecurity/19979 · Telegram Post
• https://t.me/cibsecurity/19823 · Telegram Post
• https://t.me/cibsecurity/20115 · Telegram Post
• https://t.me/cibsecurity/19883 · Telegram Post