CVE-2020-7486: High severity schneider electric tricon tcm 4351 firmware vulnerability

Published Apr 15, 2020

Updated

VERSION NOT SUPPORTED WHEN ASSIGNED A vulnerability could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x. This vulnerability was discovered and remediated in version v10.5.x on August 13, 2009. TCMs from v10.5.x and on will no longer exhibit this behavior.

Affected Software

18 affected components

Schneider-electric Tricon Tcm 4351 Firmware=10.3.x

Schneider-electric Tricon Tcm 4351 Firmware=10.4.x

Schneider-electric Tricon Tcm 4351

Schneider-electric Tricon Tcm 4352 Firmware=10.3.x

Schneider-electric Tricon Tcm 4352 Firmware=10.4.x

Schneider-electric Tricon Tcm 4352

Schneider-electric Tricon Tcm 4351a Firmware=10.3.x

Schneider-electric Tricon Tcm 4351a Firmware=10.4.x

Schneider-electric Tricon Tcm 4351a

Schneider-electric Tricon Tcm 4351b Firmware=10.3.x

Schneider-electric Tricon Tcm 4351b Firmware=10.4.x

Schneider-electric Tricon Tcm 4351b

Schneider-electric Tricon Tcm 4352a Firmware=10.3.x

Schneider-electric Tricon Tcm 4352a Firmware=10.4.x

Schneider-electric Tricon Tcm 4352a

Schneider-electric Tricon Tcm 4352b Firmware=10.3.x

Schneider-electric Tricon Tcm 4352b Firmware=10.4.x

Schneider-electric Tricon Tcm 4352b

Event History

Apr 15, 2020

CVE Published

via MITRE·09:03 PM

Data Sourced

via MITRE·09:03 PM

DescriptionWeakness

Aug 4, 2024

Data Sourced

via ICS·09:37 AM

SeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-205-01

Frequently Asked Questions

What is CVE-2020-7486?

CVE-2020-7486 is a vulnerability that could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x.

How severe is CVE-2020-7486?

CVE-2020-7486 has a severity rating of 7.5 (high).

Which software versions are affected by CVE-2020-7486?

CVE-2020-7486 affects TCM v10.4.x and system v10.3.x.

When was CVE-2020-7486 discovered and fixed?

CVE-2020-7486 was discovered and fixed in version v10.5.x on August 13, 2009.

How can I learn more about CVE-2020-7486?

You can find more information about CVE-2020-7486 on the US-CERT advisory (ID: ICSA-20-205-01) and the Schneider Electric security bulletin (ID: SESB-2020-105-01).