The vulnerability of the programming software for PLCs (programmable logic controllers), namely EcoStruxure Control Expert, and the micro-programming software for Schneider Electric’s Modicon M340 and Modicon M580 models. This vulnerability exists due to the failure to take measures to neutralize certain special elements, allowing a perpetrator to execute arbitrary codes.

🗓️ 30 Jul 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 4 Views

Vulnerability in EcoStruxure Control Expert and Modicon M340 M580 enables remote code execution.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2020-7475	31 Mar 202015:34	–	circl
CNVD	Injection Vulnerability in Multiple Schneider Electric Products	24 Mar 202000:00	–	cnvd
CVE	CVE-2020-7475	23 Mar 202018:56	–	cve
Cvelist	CVE-2020-7475	23 Mar 202018:56	–	cvelist
EUVD	EUVD-2020-28600	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in Schneider Electric products	14 May 202100:00	–	ncsc
NVD	CVE-2020-7475	23 Mar 202019:15	–	nvd
Tenable Nessus	Schneider-electric Ecostruxure Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	27 May 202000:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Injection (CVE-2020-7475)	7 Feb 202200:00	–	nessus
Prion	Design/Logic Flaw	23 Mar 202019:15	–	prion

Vulners

Node

schneider_electric ecostruxure_control_expertRange<14.0

OR

schneider_electric modicon_m340Range<3.20

OR

schneider_electric modicon_m580Range<3.10

Source	Link
se	www.se.com/ww/en/download/document/SEVD-2020-080-01
download	www.download.schneider-electric.com/files
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-7475
web	www.web.nvd.nist.gov/view/vuln/detail

30 Jul 2021 00:00Current

8.1High risk

Vulners AI Score8.1

CVSS 39.8

CVSS 210

EPSS0.01542

EcoStruxure Control Expert Modicon M340 Modicon M580 Remote code execution Unneutralized components