CVE-2020-7540: schneider-electric 140cpu65150_firmware

Vulnerability summary

CVE-2020-7540 is a critical (CVSS 9.8) vulnerability in schneider-electric 140cpu65150_firmware. EPSS estimates a 2.32% chance of exploitation in the next 30 days, higher than 83.1% of scored vulnerabilities.

Timeline

1. 11-12-2020
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause unauthenticated command execution in the controller when sending special HTTP requests.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.