PT-2020-6658 · Schneider Electric · Modicon M340+3

Published 2020-11-18 · Updated 2026-05-29 · CVE-2020-7564

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Modicon M340 versions (affected versions not specified) Modicon Quantum versions (affected versions not specified) Modicon Premium Legacy versions (affected versions not specified) Communication Modules versions (affected versions not specified)

Description A buffer copy without checking the size of input issue exists in the Web Server, which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP. This could allow a remote attacker to execute arbitrary commands.

Recommendations For Modicon M340, update the firmware to a version that includes the fix for this issue. For Modicon Quantum, update the firmware to a version that includes the fix for this issue. For Modicon Premium Legacy, update the firmware to a version that includes the fix for this issue. For Communication Modules, update the firmware to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the FTP service to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-03130

CVE-2020-7564

Affected Products

Communication Modules

Modicon M340

Modicon Premium Legacy

Modicon Quantum

References · 9

• https://bdu.fstec.ru/vul/2022-03130 · Security Note
• https://se.com/ww/en/download/document/SEVD-2020-315-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7564 · Security Note
• https://fortiguard.com/zeroday/FG-VD-20-107 · Note
• https://t.me/cibsecurity/17381 · Telegram Post
• https://t.me/cibsecurity/16509 · Telegram Post
• https://t.me/cvenotify/5761 · Telegram Post
• https://t.me/cveNotify/165195 · Telegram Post
• https://t.me/cvenotify/6479 · Telegram Post