Path Traversal Flaw in Modicon Products by Schneider Electric
CVE-2020-7535

7.5HIGH

Key Information:

Vendor
Schneider Electric
Status
Web Server On Modicon M340, Legacy Offers Modicon Quantum And Modicon Premium And Associated Communication Modules (see Security Notification For Affected Versions)
Vendor
CVE Published:
11 December 2020

Summary

A path traversal vulnerability exists in the Web Server of Schneider Electric's Modicon M340, Modicon Quantum, and Modicon Premium series, as well as in their associated communication modules. This security flaw could allow an attacker to craft specific HTTP requests that exploit improper limitations on file paths, potentially leading to the unauthorized disclosure of sensitive information.

Affected Version(s)

Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected ) Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions)

References

https://www.se.com/ww/en/download/document/SEVD-2020-343-05/
x_refsource_CONFIRM

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.