CVE-2020-7563

HIGH

Modicon M340, Quantum and Premium Legacy - Out-of-bounds Write via FTP File Upload

Title source: llm
STIX 2.1

Description

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0107
EPSS Percentile 61.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-787
Status published
Products (21)
None/Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communicatio
schneider-electric/modicon_m340_bmx_noc_0401_firmware
schneider-electric/modicon_m340_bmx_noe_0100_firmware
schneider-electric/modicon_m340_bmx_noe_0100h_firmware
schneider-electric/modicon_m340_bmx_noe_0110_firmware
schneider-electric/modicon_m340_bmx_noe_0110h_firmware
schneider-electric/modicon_m340_bmx_nor_0200h_firmware
schneider-electric/modicon_m340_bmx_p34-2010_firmware
schneider-electric/modicon_m340_bmx_p34-2030_firmware
schneider-electric/modicon_quantum_140cpu65150_firmware
... and 11 more
Published Nov 18, 2020
Tracked Since Feb 18, 2026