CVE-2020-7535

published 2020-12-11

CVE-2020-7535: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on Modicon…

Priority P3 44 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C H I N A N

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause disclosure of information when sending a specially crafted request to the controller over HTTP.

Affected

11 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	140noe77101_firmware	< 7.3	7.3
schneider-electric	140noe77111_firmware	< 7.3	7.3
schneider-electric	bmxnoe0100_firmware	< 3.4	3.4
schneider-electric	bmxnoe0110_firmware	< 6.6	6.6
schneider-electric	modicon_m340_bmxp341000_firmware	< 3.30	3.30
schneider-electric	modicon_m340_bmxp342000_firmware	< 3.30	3.30
schneider-electric	modicon_m340_bmxp3420102_firmware	< 3.30	3.30
schneider-electric	modicon_m340_bmxp3420102cl_firmware	< 3.30	3.30
schneider-electric	modicon_m340_bmxp342020_firmware	< 3.30	3.30
schneider-electric	modicon_m340_bmxp3420302_firmware	< 3.30	3.30
schneider-electric	modicon_m340_bmxp3420302cl_firmware	< 3.30	3.30

CVSS provenance

nvd v3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-22