CVE-2020-7535: Path Traversal
First published: Fri Dec 11 2020(Updated: )
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause disclosure of information when sending a specially crafted request to the controller over HTTP.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Schneider Electric Modicon M340 BMXP341000 Firmware | <3.30 | |
| Schneider Electric Modicon M340 BMXP341000 | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP342000 Firmware | <3.30 | |
| Schneider Electric Modicon M340 BMXP342000 Firmware | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP3420102 Firmware | <3.30 | |
| Schneider Electric Modicon M340 BMXP3420102 | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP3420102CL Firmware | <3.30 | |
| Schneider Electric Modicon M340 BMXP3420102CL Firmware | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP342020 Firmware | <3.30 | |
| Schneider Electric Modicon M340 BMXP342020 | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP3420302 Firmware | <3.30 | |
| Schneider Electric Modicon M340 BMXP3420302 Firmware | ||
| All of | ||
| Schneider Electric Modicon M340 BMXP3420302 Firmware | <3.30 | |
| Schneider Electric Modicon M340 BMXP3420302CL | ||
| All of | ||
| Schneider Electric BMXNOE0100 Firmware | <3.4 | |
| schneider-electric bmxnoe0100 | ||
| All of | ||
| schneider-electric BMXNOE0110H | <6.6 | |
| schneider-electric BMXNOE0110H | ||
| All of | ||
| Schneider Electric 140NOE77101 | <7.3 | |
| Schneider-electric Quantum Ethernet Module 140noe77101 | ||
| All of | ||
| Schneider Electric 140NOE77111 | <7.3 | |
| Schneider Electric 140NOE77111 | ||
| All of | ||
| Schneider Electric 140CPU65150 Firmware | ||
| Schneider Electric 140CPU65150 Firmware | ||
| All of | ||
| Schneider Electric 140CPU65160 Firmware | ||
| Schneider Electric 140CPU65160 | ||
| All of | ||
| Schneider Electric 140NOC78000 | ||
| schneider-electric 140noc78000 firmware | ||
| All of | ||
| schneider-electric 140noc78100 firmware | ||
| Schneider Electric 140NOC78100 | ||
| All of | ||
| Schneider Electric 140NOC77101 Firmware | ||
| Schneider Electric 140NOC77101 Firmware | ||
| All of | ||
| Schneider Electric Modicon TSXP574634 Firmware | ||
| schneider-electric TSXP574634 firmware | ||
| All of | ||
| schneider-electric TSXP575634 | ||
| schneider-electric tsxp575634mc | ||
| All of | ||
| Schneider Electric TSXP576634 Firmware | ||
| schneider-electric tsxp576634mc | ||
| All of | ||
| Schneider Electric TSXETY4103 Firmware | ||
| Schneider Electric TSXETY4103C | ||
| All of | ||
| schneider-electric tsxety5103c firmware | ||
| schneider-electric TSXETY5103 firmware | ||
| Schneider Electric BMXP341000 Firmware | <3.30 | |
| Schneider Electric BMXP341000 Firmware | ||
| Schneider Electric BMXP342000 Firmware | <3.30 | |
| Schneider Electric BMXP342000 Firmware | ||
| Schneider Electric BMXP3420102 Firmware | <3.30 | |
| Schneider Electric BMXP3420102 Firmware | ||
| schneider-electric bmxp3420102cl firmware | <3.30 | |
| Schneider Electric BMXP3420102CL | ||
| schneider-electric BMXP342020H firmware | <3.30 | |
| schneider-electric BMXP342020H firmware | ||
| Schneider Electric BMXP3420302H firmware | <3.30 | |
| Schneider Electric BMXP3420302H firmware | ||
| Schneider Electric BMXP3420302CL Firmware | <3.30 | |
| Schneider Electric BMXP3420302CL Firmware | ||
| Schneider Electric BMXNOE0100 Firmware | <3.4 | |
| schneider-electric bmxnoe0100 | ||
| schneider-electric BMXNOE0110H | <6.6 | |
| schneider-electric BMXNOE0110H | ||
| Schneider Electric 140NOE77101 | <7.3 | |
| Schneider-electric Quantum Ethernet Module 140noe77101 | ||
| Schneider Electric 140NOE77111 | <7.3 | |
| Schneider Electric 140NOE77111 | ||
| Schneider Electric 140CPU65150 Firmware | ||
| Schneider Electric 140CPU65150 Firmware | ||
| Schneider Electric 140CPU65160 Firmware | ||
| Schneider Electric 140CPU65160 | ||
| Schneider Electric 140NOC78000 | ||
| schneider-electric 140noc78000 firmware | ||
| schneider-electric 140noc78100 firmware | ||
| Schneider Electric 140NOC78100 | ||
| Schneider Electric 140NOC77101 Firmware | ||
| Schneider Electric 140NOC77101 Firmware | ||
| Schneider Electric Modicon TSXP574634 Firmware | ||
| schneider-electric TSXP574634 firmware | ||
| schneider-electric TSXP575634 | ||
| schneider-electric tsxp575634mc | ||
| Schneider Electric TSXP576634 Firmware | ||
| schneider-electric tsxp576634mc | ||
| Schneider Electric TSXETY4103 Firmware | ||
| Schneider Electric TSXETY4103C | ||
| schneider-electric tsxety5103c firmware | ||
| schneider-electric TSXETY5103 firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-7535?
CVE-2020-7535 is a vulnerability known as Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) that exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules.
What is the severity of CVE-2020-7535?
The severity of CVE-2020-7535 is high with a severity value of 7.5.
What software is affected by CVE-2020-7535?
The affected software includes Schneider-electric Bmxp341000 Firmware, Schneider-electric Bmxp342000 Firmware, Schneider-electric Bmxp3420102 Firmware, Schneider-electric Bmxp3420102cl Firmware, Schneider-electric Bmxp342020 Firmware, Schneider-electric Bmxp3420302 Firmware, Schneider-electric Bmxp3420302cl Firmware, Schneider-electric Bmxnoe0100 Firmware, Schneider-electric Bmxnoe0110 Firmware, Schneider-electric 140noe77101 Firmware, Schneider-electric 140noe77111 Firmware, Schneider-electric 140cpu65150 Firmware, Schneider-electric 140cpu65160 Firmware, Schneider-electric 140noc78000 Firmware, Schneider-electric 140noc78100 Firmware, Schneider-electric 140noc77101 Firmware, Schneider-electric Tsxp574634 Firmware, Schneider-electric Tsxp575634 Firmware, Schneider-electric Tsxp576634 Firmware, Schneider-electric Tsxety4103 Firmware, and Schneider-electric Tsxety5103 Firmware.
How does CVE-2020-7535 affect the affected software?
CVE-2020-7535 allows an attacker to perform Path Traversal attacks and potentially access restricted directories and files on the affected software.
How can I fix CVE-2020-7535?
To fix CVE-2020-7535, it is recommended to apply the necessary security updates provided by Schneider Electric. Additionally, following security best practices such as restricting access to the affected software can help mitigate the vulnerability.
- agent/type
- agent/severity
- agent/references
- agent/weakness
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/author
- vendor/schneider-electric
- canonical/schneider electric modicon m340 bmxp341000 firmware
- canonical/schneider electric modicon m340 bmxp341000
- canonical/schneider electric modicon m340 bmxp342000 firmware
- canonical/schneider electric modicon m340 bmxp3420102 firmware
- canonical/schneider electric modicon m340 bmxp3420102
- canonical/schneider electric modicon m340 bmxp3420102cl firmware
- canonical/schneider electric modicon m340 bmxp342020 firmware
- canonical/schneider electric modicon m340 bmxp342020
- canonical/schneider electric modicon m340 bmxp3420302 firmware
- canonical/schneider electric modicon m340 bmxp3420302cl
- canonical/schneider electric bmxnoe0100 firmware
- canonical/schneider-electric bmxnoe0100
- canonical/schneider-electric bmxnoe0110h
- canonical/schneider electric 140noe77101
- canonical/schneider-electric quantum ethernet module 140noe77101
- canonical/schneider electric 140noe77111
- canonical/schneider electric 140cpu65150 firmware
- canonical/schneider electric 140cpu65160 firmware
- canonical/schneider electric 140cpu65160
- canonical/schneider electric 140noc78000
- canonical/schneider-electric 140noc78000 firmware
- canonical/schneider-electric 140noc78100 firmware
- canonical/schneider electric 140noc78100
- canonical/schneider electric 140noc77101 firmware
- canonical/schneider electric modicon tsxp574634 firmware
- canonical/schneider-electric tsxp574634 firmware
- canonical/schneider-electric tsxp575634
- canonical/schneider-electric tsxp575634mc
- canonical/schneider electric tsxp576634 firmware
- canonical/schneider-electric tsxp576634mc
- canonical/schneider electric tsxety4103 firmware
- canonical/schneider electric tsxety4103c
- canonical/schneider-electric tsxety5103c firmware
- canonical/schneider-electric tsxety5103 firmware
- canonical/schneider electric bmxp341000 firmware
- canonical/schneider electric bmxp342000 firmware
- canonical/schneider electric bmxp3420102 firmware
- canonical/schneider-electric bmxp3420102cl firmware
- canonical/schneider electric bmxp3420102cl
- canonical/schneider-electric bmxp342020h firmware
- canonical/schneider electric bmxp3420302h firmware
- canonical/schneider electric bmxp3420302cl firmware