Skip to main content

Modicon M340 Bmxp3420302 Firmware CVE-2020-7533

CRITICAL
Improper Authentication (CWE-287)
2020-12-01 cybersecurity@se.com
Authentication Bypass Modicon M340 Bmxp3420302 Firmware Modicon M340 Bmxp342000 Firmware Modicon M340 Bmxp341000 Firmware Modicon M340 Bmxp3420102 Firmware Bmxnoe0100 Firmware Bmxnoe0110 Firmware Bmxnoc0401 Firmware Tsxp574634 Firmware Tsxp575634 Firmware Tsxp576634 Firmware Tsxety4103 Firmware Tsxety5103 Firmware 140Noe77111 Firmware 140Noc78000 Firmware 140Noc77101 Firmware 140Cpu65260 Firmware
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

1
CVE Published
Dec 01, 2020 - 15:15 nvd
CRITICAL 9.8

DescriptionNVD

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

AnalysisAI

commands on the webserver without authentication when sending specially crafted HTTP requests. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified as Improper Authentication (CWE-287), which allows attackers to bypass authentication mechanisms to gain unauthorized access. commands on the webserver without authentication when sending specially crafted HTTP requests. Affected products include: Schneider-Electric Modicon M340 Bmxp3420302 Firmware, Schneider-Electric Modicon M340 Bmxp342000 Firmware, Schneider-Electric Modicon M340 Bmxp341000 Firmware, Schneider-Electric Modicon M340 Bmxp3420102 Firmware, Schneider-Electric Bmxnoe0100 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Implement multi-factor authentication, enforce strong password policies, use proven authentication frameworks.

More in Modicon M340 Bmxp3420302 Firmware

View all
CVE-2014-0754 CRITICAL
10.0 Oct 03

Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec befo
CVE-2022-37300 CRITICAL
9.8 Sep 12

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized ac
CVE-2020-7540 CRITICAL
9.8 Dec 11

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy O
CVE-2018-7761 CRITICAL
9.8 Apr 18

A vulnerability exists in the HTTP request parser in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum
CVE-2018-7760 CRITICAL
9.8 Apr 18

An authorization bypass vulnerability exists in Schneider Electric's Modicon M340, Modicon Premium, Modicon Quantum PLC,
CVE-2018-7242 CRITICAL
9.8 Apr 18

Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200
CVE-2018-7241 CRITICAL
9.8 Apr 18

Hard coded accounts exist in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 control
CVE-2017-6017 HIGH
7.5 Jun 30

A Resource Exhaustion issue was discovered in Schneider Electric Modicon M340 PLC BMXNOC0401, BMXNOE0100, BMXNOE0110, BM
CVE-2022-0222 HIGH
7.5 Nov 22

A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet commu
CVE-2020-7543 HIGH
7.5 Dec 11

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Lega
CVE-2020-7542 HIGH
7.5 Dec 11

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Lega
CVE-2020-7539 HIGH
7.5 Dec 11

A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, L

Same weakness CWE-287 – Improper Authentication

View all
CVE-2020-0688 HIGH POC
8.8
CVE-2023-46805 HIGH POC
8.2
CVE-2015-1187 CRITICAL POC
9.8
CVE-2024-7593 CRITICAL POC
9.8
CVE-2017-7921 CRITICAL POC
9.8
CVE-2024-53704 CRITICAL POC
9.8
CVE-2015-7755 CRITICAL POC
9.8
CVE-2013-0625 CRITICAL POC
9.8

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2020-7533 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy