CVE-2020-7535: Path Traversal
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause disclosure of information when sending a specially crafted request to the controller over HTTP.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-7535?
CVE-2020-7535 is a vulnerability known as Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) that exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules.
What is the severity of CVE-2020-7535?
The severity of CVE-2020-7535 is high with a severity value of 7.5.
What software is affected by CVE-2020-7535?
The affected software includes Schneider-electric Bmxp341000 Firmware, Schneider-electric Bmxp342000 Firmware, Schneider-electric Bmxp3420102 Firmware, Schneider-electric Bmxp3420102cl Firmware, Schneider-electric Bmxp342020 Firmware, Schneider-electric Bmxp3420302 Firmware, Schneider-electric Bmxp3420302cl Firmware, Schneider-electric Bmxnoe0100 Firmware, Schneider-electric Bmxnoe0110 Firmware, Schneider-electric 140noe77101 Firmware, Schneider-electric 140noe77111 Firmware, Schneider-electric 140cpu65150 Firmware, Schneider-electric 140cpu65160 Firmware, Schneider-electric 140noc78000 Firmware, Schneider-electric 140noc78100 Firmware, Schneider-electric 140noc77101 Firmware, Schneider-electric Tsxp574634 Firmware, Schneider-electric Tsxp575634 Firmware, Schneider-electric Tsxp576634 Firmware, Schneider-electric Tsxety4103 Firmware, and Schneider-electric Tsxety5103 Firmware.
How does CVE-2020-7535 affect the affected software?
CVE-2020-7535 allows an attacker to perform Path Traversal attacks and potentially access restricted directories and files on the affected software.
How can I fix CVE-2020-7535?
To fix CVE-2020-7535, it is recommended to apply the necessary security updates provided by Schneider Electric. Additionally, following security best practices such as restricting access to the affected software can help mitigate the vulnerability.