Skip to content
OpenAdvisories
Critical SEVD-2020-287-01 1 CVE

Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules

Published Oct 13, 2020 · Updated Jun 10, 2025 · Revision 2

Vendor: Schneider Electric Product: M340 BMXP341000 and H Product: M340 BMXP342000 Product: M340 BMXP3420102 and CL Product: M340 BMXP342020 and H Product: M340 BMXP3420302 Product: M340 BMXP3420302 and CL and H Product: M340 Communication Ethernet modules BMX NOC 0401 Product: M340 Communication Ethernet modules BMX NOE 0100 (H) Product: M340 Communication Ethernet modules BMX NOE 0110 (H) Product: M340 Communication Ethernet modules BMXNOC0401 Product: M340 Communication Ethernet modules BMXNOE0100 and H Product: M340 Communication Ethernet modules BMXNOE0110 and H Product: M340 CPUs BMX P34x Product: Premium communication modules TSXETY4103 Product: Premium communication modules TSXETY5103 Product: Premium Offers Premium processors with integrated Ethernet COPRO product references TSXP574634, TSXP575634, TSXP576634 Product: Premium Offers TSXETY4103 Product: Premium Offers TSXETY5103 Product: Premium processors with integrated Ethernet COPRO TSXP574634, TSXP575634, TSXP576634 Product: Quantum communication modules 140NOC77101 Product: Quantum communication modules 140NOC78x00 Product: Quantum communication modules 140NOE771x1 Product: Quantum Offers 140NOC77101 Product: Quantum Offers 140NOC78x00 Product: Quantum Offers 140NOE771x1 Product: Quantum Offers Quantum processors with integrated Ethernet COPRO product reference 140CPU65xxxxx Product: Quantum processors with integrated Ethernet COPRO 140CPU65xxxxx

Summary

Schneider Electric is aware of a vulnerability in the web server of the Modicon M340, Modicon
Quantum and Modicon Premium Legacy offers and their communication modules.
The Modicon Ethernet Programmable Automation products are controllers for industrial process
and infrastructure.
Failure to apply the remediations provided below may risk execution of commands on the
webserver by an authenticated attacker, which could result in loss of availability, confidentiality
and integrity on the controller.

Vulnerabilities 1

  • Unscored —
    CVE-2020-7533

    CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver with…

Revision history

  1. #1.1.0

    CWE was updated.

  2. #1.0.0

    Original Release

References