CVE-2020-7564

HIGH

Modicon M340, Quantum and Premium Legacy - Classic Buffer Overflow via FTP File Upload

Title source: llm
STIX 2.1

Description

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.

References (1)

Core 1
Core References

Scores

CVSS v3 8.8
EPSS 0.0109
EPSS Percentile 61.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-120
Status published
Products (21)
None/Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communicatio
schneider-electric/modicon_m340_bmx_noc_0401_firmware
schneider-electric/modicon_m340_bmx_noe_0100_firmware
schneider-electric/modicon_m340_bmx_noe_0100h_firmware
schneider-electric/modicon_m340_bmx_noe_0110_firmware
schneider-electric/modicon_m340_bmx_noe_0110h_firmware
schneider-electric/modicon_m340_bmx_nor_0200h_firmware
schneider-electric/modicon_m340_bmx_p34-2010_firmware
schneider-electric/modicon_m340_bmx_p34-2030_firmware
schneider-electric/modicon_quantum_140cpu65150_firmware
... and 11 more
Published Nov 18, 2020
Tracked Since Feb 18, 2026