CVE-2020-7562

HIGH

Modicon M340, Quantum, and Premium Legacy - Out-of-bounds Read via FTP File Upload

Title source: llm
STIX 2.1

Description

A CWE-125: Out-of-Bounds Read vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP.

References (1)

Core 1
Core References

Scores

CVSS v3 8.1
EPSS 0.0088
EPSS Percentile 54.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-125
Status published
Products (21)
None/Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communicatio
schneider-electric/modicon_m340_bmx_noc_0401_firmware
schneider-electric/modicon_m340_bmx_noe_0100_firmware
schneider-electric/modicon_m340_bmx_noe_0100h_firmware
schneider-electric/modicon_m340_bmx_noe_0110_firmware
schneider-electric/modicon_m340_bmx_noe_0110h_firmware
schneider-electric/modicon_m340_bmx_nor_0200h_firmware
schneider-electric/modicon_m340_bmx_p34-2010_firmware
schneider-electric/modicon_m340_bmx_p34-2030_firmware
schneider-electric/modicon_quantum_140cpu65150_firmware
... and 11 more
Published Nov 18, 2020
Tracked Since Feb 18, 2026