Details of VAR-202012-1384

ID

VAR-202012-1384

CVE

CVE-2020-7549

TITLE

plural Schneider Electric Product Exceptional Status Check Vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2020-014322

DESCRIPTION

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause denial of HTTP and FTP services when a series of specially crafted requests is sent to the controller over HTTP. plural Schneider Electric The product contains a vulnerability related to checking for exceptional conditions.Denial of service (DoS) It may be put into a state. Schneider Electric Modicon M340 is a medium-range PLC (Programmable Logic Controller) of French Schneider Electric (Schneider Electric) for industrial processes and infrastructure. Schneider Electric Modicon M340 has a code issue vulnerability. Attackers can use the vulnerability to make HTTP and FTP services deny when a request for preparation is sent to the controller via HTTP

Trust: 2.16

sources: NVD: CVE-2020-7549 // JVNDB: JVNDB-2020-014322 // CNVD: CNVD-2021-46283

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2021-46283

AFFECTED PRODUCTS

vendor:	schneider electric	model:	bmxnoe0110	scope:	lt	version:	6.6	Trust: 1.0
vendor:	schneider electric	model:	140cpu65150	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	tsxety4103	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	tsxety5103	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420102	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420302	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	tsxp575634	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342020	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp341000	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	bmxnoe0100	scope:	lt	version:	3.4	Trust: 1.0
vendor:	schneider electric	model:	tsxp576634	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420102cl	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	140noc78100	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	140noc78000	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp3420302cl	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	bmxnoc0401	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	140noe77111	scope:	lt	version:	7.3	Trust: 1.0
vendor:	schneider electric	model:	tsxp574634	scope:	eq	version:	*	Trust: 1.0
vendor:	schneider electric	model:	modicon m340 bmxp342000	scope:	lt	version:	3.30	Trust: 1.0
vendor:	schneider electric	model:	bmxnoc0401	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxnoe0110	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420102	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420302cl	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420102cl	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp342020	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp342000	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp341000	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxp3420302	scope:	-	version:	-	Trust: 0.8
vendor:	schneider electric	model:	bmxnoe0100	scope:	-	version:	-	Trust: 0.8
vendor:	schneider	model:	electric modicon m340	scope:	-	version:	-	Trust: 0.6

sources: CNVD: CNVD-2021-46283 // JVNDB: JVNDB-2020-014322 // NVD: CVE-2020-7549

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2020-7549
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2020-7549
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2021-46283
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-202012-939
value:	MEDIUM
Trust: 0.6

nvd@nist.gov:	CVE-2020-7549
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2021-46283
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

nvd@nist.gov:	CVE-2020-7549
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	3.9
impactScore:	1.4
version:	3.1
Trust: 1.0
NVD:	CVE-2020-7549
baseSeverity:	MEDIUM
baseScore:	5.3
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	LOW
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: CNVD: CNVD-2021-46283 // JVNDB: JVNDB-2020-014322 // CNNVD: CNNVD-202012-939 // NVD: CVE-2020-7549

PROBLEMTYPE DATA

problemtype:	CWE-754	Trust: 1.0
problemtype:	Improper checking in exceptional conditions (CWE-754) [ Other ]	Trust: 0.8

sources: JVNDB: JVNDB-2020-014322 // NVD: CVE-2020-7549

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202012-939

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-202012-939

PATCH

title:	SEVD-2020-343-06	url:	https://www.se.com/ww/en/download/document/SEVD-2020-343-06/	Trust: 0.8
title:	Patch for Schneider Electric Modicon M340 code issue vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/276471	Trust: 0.6
title:	Schneider Electric Modicon M340 Fixes for code issue vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=136601	Trust: 0.6

sources: CNVD: CNVD-2021-46283 // JVNDB: JVNDB-2020-014322 // CNNVD: CNNVD-202012-939

EXTERNAL IDS

db:	NVD	id:	CVE-2020-7549	Trust: 3.0
db:	SCHNEIDER	id:	SEVD-2020-343-06	Trust: 1.6
db:	JVNDB	id:	JVNDB-2020-014322	Trust: 0.8
db:	CNVD	id:	CNVD-2021-46283	Trust: 0.6
db:	CNNVD	id:	CNNVD-202012-939	Trust: 0.6

sources: CNVD: CNVD-2021-46283 // JVNDB: JVNDB-2020-014322 // CNNVD: CNNVD-202012-939 // NVD: CVE-2020-7549

REFERENCES

url:	https://www.se.com/ww/en/download/document/sevd-2020-343-06/	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2020-7549	Trust: 1.4

sources: CNVD: CNVD-2021-46283 // JVNDB: JVNDB-2020-014322 // CNNVD: CNNVD-202012-939 // NVD: CVE-2020-7549

SOURCES

db:	CNVD	id:	CNVD-2021-46283
db:	JVNDB	id:	JVNDB-2020-014322
db:	CNNVD	id:	CNNVD-202012-939
db:	NVD	id:	CVE-2020-7549

LAST UPDATE DATE

2024-11-23T22:16:10.514000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2021-46283	date:	2021-07-01T00:00:00
db:	JVNDB	id:	JVNDB-2020-014322	date:	2021-08-13T08:50:00
db:	CNNVD	id:	CNNVD-202012-939	date:	2020-12-16T00:00:00
db:	NVD	id:	CVE-2020-7549	date:	2024-11-21T05:37:21.663

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2021-46283	date:	2021-07-01T00:00:00
db:	JVNDB	id:	JVNDB-2020-014322	date:	2021-08-13T00:00:00
db:	CNNVD	id:	CNNVD-202012-939	date:	2020-12-11T00:00:00
db:	NVD	id:	CVE-2020-7549	date:	2020-12-11T01:15:12.627