CVE-2020-7475

🗓️ 23 Mar 2020 18:56:18Reported by schneiderType

Vulnerability in EcoStruxure Control Expert, Unity Pro, Modicon M340, and Modicon M58

Reporter	Title	Published	Views	Family All 11
BDU FSTEC	The vulnerability of the programming software for PLCs (programmable logic controllers), namely EcoStruxure Control Expert, and the micro-programming software for Schneider Electric’s Modicon M340 and Modicon M580 models. This vulnerability exists due to the failure to take measures to neutralize certain special elements, allowing a perpetrator to execute arbitrary codes.	30 Jul 202100:00	–	bdu_fstec
Circl	CVE-2020-7475	31 Mar 202015:34	–	circl
CNVD	Injection Vulnerability in Multiple Schneider Electric Products	24 Mar 202000:00	–	cnvd
CVE	CVE-2020-7475	23 Mar 202018:56	–	cve
EUVD	EUVD-2020-28600	7 Oct 202500:30	–	euvd
NCSC	Vulnerabilities fixed in Schneider Electric products	14 May 202100:00	–	ncsc
NVD	CVE-2020-7475	23 Mar 202019:15	–	nvd
Tenable Nessus	Schneider-electric Ecostruxure Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	27 May 202000:00	–	nessus
Tenable Nessus	Schneider Electric Modicon Injection (CVE-2020-7475)	7 Feb 202200:00	–	nessus
Prion	Design/Logic Flaw	23 Mar 202019:15	–	prion

[
  {
    "product": "EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)"
      }
    ]
  }
]

Source	Link
se	www.se.com/ww/en/download/document/SEVD-2020-080-01

23 Mar 2020 18:56Current

9.5High risk

Vulners AI Score9.5

EPSS0.00571

CWE-74