CVE-2020-7487
First published: Wed Apr 22 2020(Updated: )
A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider-electric Ecostruxure Machine Expert | ||
| Schneider-electric Somachine | ||
| Schneider-electric Somachine Motion | ||
| Schneider-electric Modicon M218 Firmware | ||
| Schneider-electric Modicon M218 | ||
| Schneider-electric Modicon M241 Firmware | ||
| Schneider-electric Modicon M241 | ||
| Schneider-electric Modicon M251 Firmware | ||
| Schneider-electric Modicon M251 | ||
| Schneider-electric Modicon M258 Firmware | ||
| Schneider-electric Modicon M258 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-7487?
CVE-2020-7487 is a vulnerability that allows an attacker to execute malicious code on Modicon M218, M241, M251, and M258 controllers.
Which software is affected by CVE-2020-7487?
CVE-2020-7487 affects Schneider-electric Ecostruxure Machine Expert, Schneider-electric Somachine, and Schneider-electric Somachine Motion.
How severe is CVE-2020-7487?
CVE-2020-7487 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2020-7487?
An attacker can exploit CVE-2020-7487 by leveraging the insufficient verification of data authenticity vulnerability to execute malicious code on the affected controllers.
Is there a fix for CVE-2020-7487?
Schneider-electric has released a security advisory (SEVD-2020-105-02) providing mitigation steps and patches to address CVE-2020-7487.
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/first-publish-date
- agent/softwarecombine
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/schneider-electric
- canonical/schneider-electric ecostruxure machine expert
- canonical/schneider-electric somachine
- canonical/schneider-electric somachine motion
- canonical/schneider-electric modicon m218 firmware
- canonical/schneider-electric modicon m218
- canonical/schneider-electric modicon m241 firmware
- canonical/schneider-electric modicon m241
- canonical/schneider-electric modicon m251 firmware
- canonical/schneider-electric modicon m251
- canonical/schneider-electric modicon m258 firmware
- canonical/schneider-electric modicon m258