CVE-2020-7564: Buffer Overflow
First published: Wed Nov 18 2020(Updated: )
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| schneider-electric Modicon tsxety4103 | ||
| schneider-electric Modicon TSXETY4103 Firmware | ||
| Schneider Electric Modicon TSXETY5103 Firmware | ||
| Schneider Electric Modicon TSXETY5103 Firmware | ||
| Schneider Electric Modicon TSXP574634 Firmware | ||
| Schneider Electric Modicon TSXP574634 Firmware | ||
| Modicon TSXP575634 | ||
| Modicon TSXP575634 | ||
| Schneider Electric Modicon TSXP576634 | ||
| schneider-electric Modicon tsxp576634 firmware | ||
| Schneider Electric Modicon Quantum Firmware | ||
| Schneider-electric Quantum Ethernet Module 140noe77101 | ||
| schneider-electric Modicon Quantum 140noe77111 firmware | ||
| Modicon Quantum 140NOE77111 | ||
| Modicon Quantum 140noc78100 | ||
| Modicon Quantum 140noc78100 | ||
| Schneider Electric Modicon Quantum Firmware | ||
| schneider-electric Modicon Quantum 140cpu65150 firmware | ||
| Schneider Electric Modicon Quantum 140CPU65160C Firmware | ||
| schneider-electric Modicon Quantum 140cpu65150c firmware | ||
| schneider-electric Modicon Quantum 140cpu65160c | ||
| Schneider Electric Modicon Quantum 140CPU65160C Firmware | ||
| schneider-electric Modicon Quantum 140cpu65160 firmware | ||
| schneider-electric Modicon Quantum 140cpu65160c | ||
| Schneider Electric Modicon M340 Firmware | ||
| Modicon M340 | ||
| Schneider Electric Modicon M340 BMX P34-2030 Firmware | ||
| Schneider Electric Modicon M340 | ||
| schneider-electric Modicon M340 | ||
| Schneider Electric Modicon M340 BMXNOC0401 | ||
| Schneider Electric Modicon M340 BMX NOE 0100 Firmware | ||
| Schneider Electric Modicon M340 BMX NOE 0100 Firmware | ||
| Schneider Electric Modicon M340 BMX NOE 0100H Firmware | ||
| Schneider Electric Modicon M340 BMX NOE 0100H Firmware | ||
| schneider-electric Modicon M340 | ||
| Schneider Electric Modicon M340 BMX NOE 0110H | ||
| Schneider Electric Modicon M340 BMX NOE 0110H Firmware | ||
| Schneider Electric Modicon M340 BMX NOE 0110H | ||
| Schneider Electric Modicon M340 BMX NOR 0200H Firmware | ||
| Schneider Electric Modicon M340 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-7564?
The severity of CVE-2020-7564 is classified as high due to its potential to allow unauthorized write access and execution of arbitrary code.
How do I fix CVE-2020-7564?
To fix CVE-2020-7564, apply the latest firmware updates provided by Schneider Electric for the affected Modicon devices.
Which devices are affected by CVE-2020-7564?
CVE-2020-7564 affects the Modicon M340, Modicon Quantum, and Modicon Premium legacy devices and their Communication Modules.
What type of vulnerability is CVE-2020-7564?
CVE-2020-7564 is a buffer overflow vulnerability, categorized under CWE-120: Buffer Copy without Checking Size of Input.
Can CVE-2020-7564 lead to denial of service attacks?
Yes, CVE-2020-7564 could potentially be exploited to execute arbitrary code, leading to a denial of service.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/schneider-electric modicon tsxety4103
- canonical/schneider-electric modicon tsxety4103 firmware
- canonical/schneider electric modicon tsxety5103 firmware
- canonical/schneider electric modicon tsxp574634 firmware
- canonical/modicon tsxp575634
- canonical/schneider electric modicon tsxp576634
- canonical/schneider-electric modicon tsxp576634 firmware
- canonical/schneider electric modicon quantum firmware
- canonical/schneider-electric quantum ethernet module 140noe77101
- canonical/schneider-electric modicon quantum 140noe77111 firmware
- canonical/modicon quantum 140noe77111
- canonical/modicon quantum 140noc78100
- canonical/schneider-electric modicon quantum 140cpu65150 firmware
- canonical/schneider electric modicon quantum 140cpu65160c firmware
- canonical/schneider-electric modicon quantum 140cpu65150c firmware
- canonical/schneider-electric modicon quantum 140cpu65160c
- canonical/schneider-electric modicon quantum 140cpu65160 firmware
- canonical/schneider electric modicon m340 firmware
- canonical/modicon m340
- canonical/schneider electric modicon m340 bmx p34-2030 firmware
- canonical/schneider electric modicon m340
- canonical/schneider-electric modicon m340
- canonical/schneider electric modicon m340 bmxnoc0401
- canonical/schneider electric modicon m340 bmx noe 0100 firmware
- canonical/schneider electric modicon m340 bmx noe 0100h firmware
- canonical/schneider electric modicon m340 bmx noe 0110h
- canonical/schneider electric modicon m340 bmx noe 0110h firmware
- canonical/schneider electric modicon m340 bmx nor 0200h firmware