CVE-2020-7563

HIGH

Modicon M340, Quantum and Premium Legacy - Out-of-bounds Write via FTP File Upload

Title source: llm
STIX 2.1

Description

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0104
EPSS Percentile 77.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (20)
schneider-electric/modicon_m340_bmx_noc_0401_firmware
schneider-electric/modicon_m340_bmx_noe_0100_firmware
schneider-electric/modicon_m340_bmx_noe_0100h_firmware
schneider-electric/modicon_m340_bmx_noe_0110_firmware
schneider-electric/modicon_m340_bmx_noe_0110h_firmware
schneider-electric/modicon_m340_bmx_nor_0200h_firmware
schneider-electric/modicon_m340_bmx_p34-2010_firmware
schneider-electric/modicon_m340_bmx_p34-2030_firmware
schneider-electric/modicon_quantum_140cpu65150_firmware
schneider-electric/modicon_quantum_140cpu65150c_firmware
... and 10 more
Published Nov 18, 2020
Tracked Since Feb 18, 2026