by Kastro
Paper/Archive/CVE-2020-7533

CVE-2020-7533

schneider — CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication…

EPSS 2%CVSS 9.8
critical.is priorityof 100
46
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 83.6.836 × 2016.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

Affected

ProductAffectedFixed inSource
Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see security notification for version information)Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see security notification for version information)–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refdownload.schneider-electric.com/files?p_File_Name=SEVD-2020-287-01_Modicon_Web_Server_Security_Notificatiton.pdf&p_Doc_Ref=SEVD-2020-287-01&p_enDocType=Security+and+Safety+Noticerefse.com/ww/en/download/document/SEVD-2020-287-01