CVE-2014-0754: Schneider Electric
Published Oct 3, 2014
·Updated
Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.
Affected Software
172 affected components
Schneider-electric Stbnic2212 Firmware
Schneider-electric Stbnic2212
Schneider-electric Stbnip2212 Firmware
Schneider-electric Stbnip2212
Schneider-electric Tsxetc0101 Firmware
Schneider-electric Tsxetc0101
Schneider-electric Tsxetc100 Firmware
Schneider-electric Tsxetc100
Schneider-electric Tsxp573623mc Firmware
Schneider-electric Tsxp573623mc
Schneider-electric Tsxety110ws Firmware
Schneider-electric Tsxety110ws
Schneider-electric Tsxp574634m Firmware
Schneider-electric Tsxp574634m
Schneider-electric Tsxety110wsc Firmware
Schneider-electric Tsxety110wsc
Schneider-electric Tsxp574823am Firmware
Schneider-electric Tsxp574823am
Schneider-electric Tsxety4103 Firmware
Schneider-electric Tsxety4103
Schneider-electric Tsxp574823m Firmware
Schneider-electric Tsxp574823m
Schneider-electric Tsxety4103c Firmware
Schneider-electric Tsxety4103c
Schneider-electric Tsxp574823mc Firmware
Schneider-electric Tsxp574823mc
Schneider-electric Tsxety5103 Firmware
Schneider-electric Tsxety5103
Schneider-electric Tsxp575634m Firmware
Schneider-electric Tsxp575634m
Schneider-electric Tsxety5103c Firmware
Schneider-electric Tsxety5103c
Schneider-electric Tsxp576634m Firmware
Schneider-electric Tsxp576634m
Schneider-electric Tsxetz410 Firmware
Schneider-electric Tsxetz410
Schneider-electric Tsxwmy100 Firmware
Schneider-electric Tsxwmy100
Schneider-electric Tsxetz510 Firmware
Schneider-electric Tsxetz510
Schneider-electric Tsxwmy100c Firmware
Schneider-electric Tsxwmy100c
Schneider-electric Tsxntp100 Firmware
Schneider-electric Tsxntp100
Schneider-electric Modicon M580 Bmxnoc0402 Firmware
Schneider-electric Modicon M580 Bmxnoc0402
Schneider-electric Modicon M340 Bmxnoe0100 Firmware
Schneider-electric Modicon M340 Bmxnoe0100
Schneider-electric Modicon M340 Bmxnoe0110 Firmware
Schneider-electric Modicon M340 Bmxnoe0110
Schneider-electric Modicon M340 Bmxnoe0110h Firmware
Schneider-electric Modicon M340 Bmxnoe0110h
Schneider-electric Modicon M340 Bmxnor0200h Firmware
Schneider-electric Modicon M340 Bmxnor0200h
Schneider-electric Modicon M340 Bmxp342020 Firmware
Schneider-electric Modicon M340 Bmxp342020
Schneider-electric Modicon M340 Bmxp342020h Firmware
Schneider-electric Modicon M340 Bmxp342020h
Schneider-electric Modicon M340 Bmxp342030 Firmware
Schneider-electric Modicon M340 Bmxp342030
Schneider-electric Modicon M340 Bmxp3420302 Firmware
Schneider-electric Modicon M340 Bmxp3420302
Schneider-electric Modicon M340 Bmxp3420302h Firmware
Schneider-electric Modicon M340 Bmxp3420302h
Schneider-electric Modicon M340 Bmxp342030h Firmware
Schneider-electric Modicon M340 Bmxp342030h
Schneider-electric Modicon M340 Bmxnoc0401 Firmware
Schneider-electric Modicon M340 Bmxnoc0401
Schneider-electric 171ccc96020 Firmware
Schneider-electric 171ccc96020
Schneider-electric 171ccc96020c Firmware
Schneider-electric 171ccc96020c
Schneider-electric 171ccc96030 Firmware
Schneider-electric 171ccc96030
Schneider-electric 171ccc96030c Firmware
Schneider-electric 171ccc96030c
Schneider-electric 171ccc98020 Firmware
Schneider-electric 171ccc98020
Schneider-electric 171ccc98030 Firmware
Schneider-electric 171ccc98030
Schneider-electric Tsxp571634m Firmware
Schneider-electric Tsxp571634m
Schneider-electric Tsxp572634m Firmware
Schneider-electric Tsxp572634m
Schneider-electric Tsxp573634m Firmware
Schneider-electric Tsxp573634m
All of the following
Schneider-electric Stbnic2212 Firmware
Schneider-electric Stbnic2212
All of the following
Schneider-electric Stbnip2212 Firmware
Schneider-electric Stbnip2212
All of the following
Schneider-electric Tsxetc0101 Firmware
Schneider-electric Tsxetc0101
All of the following
Schneider-electric Tsxetc100 Firmware
Schneider-electric Tsxetc100
All of the following
Schneider-electric Tsxp573623mc Firmware
Schneider-electric Tsxp573623mc
All of the following
Schneider-electric Tsxety110ws Firmware
Schneider-electric Tsxety110ws
All of the following
Schneider-electric Tsxp574634m Firmware
Schneider-electric Tsxp574634m
All of the following
Schneider-electric Tsxety110wsc Firmware
Schneider-electric Tsxety110wsc
All of the following
Schneider-electric Tsxp574823am Firmware
Schneider-electric Tsxp574823am
All of the following
Schneider-electric Tsxety4103 Firmware
Schneider-electric Tsxety4103
All of the following
Schneider-electric Tsxp574823m Firmware
Schneider-electric Tsxp574823m
All of the following
Schneider-electric Tsxety4103c Firmware
Schneider-electric Tsxety4103c
All of the following
Schneider-electric Tsxp574823mc Firmware
Schneider-electric Tsxp574823mc
All of the following
Schneider-electric Tsxety5103 Firmware
Schneider-electric Tsxety5103
All of the following
Schneider-electric Tsxp575634m Firmware
Schneider-electric Tsxp575634m
All of the following
Schneider-electric Tsxety5103c Firmware
Schneider-electric Tsxety5103c
All of the following
Schneider-electric Tsxp576634m Firmware
Schneider-electric Tsxp576634m
All of the following
Schneider-electric Tsxetz410 Firmware
Schneider-electric Tsxetz410
All of the following
Schneider-electric Tsxwmy100 Firmware
Schneider-electric Tsxwmy100
All of the following
Schneider-electric Tsxetz510 Firmware
Schneider-electric Tsxetz510
All of the following
Schneider-electric Tsxwmy100c Firmware
Schneider-electric Tsxwmy100c
All of the following
Schneider-electric Tsxntp100 Firmware
Schneider-electric Tsxntp100
All of the following
Schneider-electric Modicon M580 Bmxnoc0402 Firmware
Schneider-electric Modicon M580 Bmxnoc0402
All of the following
Schneider-electric Modicon M340 Bmxnoe0100 Firmware
Schneider-electric Modicon M340 Bmxnoe0100
All of the following
Schneider-electric Modicon M340 Bmxnoe0110 Firmware
Schneider-electric Modicon M340 Bmxnoe0110
All of the following
Schneider-electric Modicon M340 Bmxnoe0110h Firmware
Schneider-electric Modicon M340 Bmxnoe0110h
All of the following
Schneider-electric Modicon M340 Bmxnor0200h Firmware
Schneider-electric Modicon M340 Bmxnor0200h
All of the following
Schneider-electric Modicon M340 Bmxp342020 Firmware
Schneider-electric Modicon M340 Bmxp342020
All of the following
Schneider-electric Modicon M340 Bmxp342020h Firmware
Schneider-electric Modicon M340 Bmxp342020h
All of the following
Schneider-electric Modicon M340 Bmxp342030 Firmware
Schneider-electric Modicon M340 Bmxp342030
All of the following
Schneider-electric Modicon M340 Bmxp3420302 Firmware
Schneider-electric Modicon M340 Bmxp3420302
All of the following
Schneider-electric Modicon M340 Bmxp3420302h Firmware
Schneider-electric Modicon M340 Bmxp3420302h
All of the following
Schneider-electric Modicon M340 Bmxp342030h Firmware
Schneider-electric Modicon M340 Bmxp342030h
All of the following
Schneider-electric Modicon M340 Bmxnoc0401 Firmware
Schneider-electric Modicon M340 Bmxnoc0401
All of the following
Schneider-electric 171ccc96020 Firmware
Schneider-electric 171ccc96020
All of the following
Schneider-electric 171ccc96020c Firmware
Schneider-electric 171ccc96020c
All of the following
Schneider-electric 171ccc96030 Firmware
Schneider-electric 171ccc96030
All of the following
Schneider-electric 171ccc96030c Firmware
Schneider-electric 171ccc96030c
All of the following
Schneider-electric 171ccc98020 Firmware
Schneider-electric 171ccc98020
All of the following
Schneider-electric 171ccc98030 Firmware
Schneider-electric 171ccc98030
All of the following
Schneider-electric Tsxp571634m Firmware
Schneider-electric Tsxp571634m
All of the following
Schneider-electric Tsxp572634m Firmware
Schneider-electric Tsxp572634m
All of the following
Schneider-electric Tsxp573634m Firmware
Schneider-electric Tsxp573634m
Remediation
Information
Please see Schneider Electric’s vulnerability disclosure
(SEVD-2014-260-01)Schneider Electric Vulnerability Disclosure – Modicon
Ethernet Comm Modules - SEVD-2014-260-01 -
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2014-260-01 . for more detailed
information on which product part numbers are affected, as well as the
complete list of which devices have released firmware updates available.
This vulnerability disclosure can be downloaded at the following URL: http://www.schneider-electric.com/ww/en/download/
Event History
Oct 3, 2014
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
RemedyDescriptionSeverity
Data Sourced
via NVD·06:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0754?
CVE-2014-0754 is categorized as a medium severity vulnerability.
2
How do I fix CVE-2014-0754?
To fix CVE-2014-0754, update the affected firmware versions of Schneider Electric Modicon PLC Ethernet modules to the latest version available.
3
What type of vulnerability is CVE-2014-0754?
CVE-2014-0754 is a directory traversal vulnerability that enables unauthorized file system access.
4
Which products are affected by CVE-2014-0754?
CVE-2014-0754 affects several Schneider Electric Modicon PLC Ethernet modules, including the 140CPU65x and others listed in the CVE record.
5
Can CVE-2014-0754 be exploited remotely?
Yes, CVE-2014-0754 can potentially be exploited remotely if appropriate network security measures are not in place.