VDB
CVE-2020-7540
CVE-2020-7540
PUBLISHED
Reported by schneider · Published December 11, 2020
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause unauthenticated command execution in the controller when sending special HTTP requests.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| modicon_m340_bmxp341000_firmware | schneider-electric | 3.30 |
| bmxnoe0100_firmware | schneider-electric | 3.3 |
| 140noe77111_firmware | schneider-electric | 7.1 |
| tsxp576634_firmware | schneider-electric | 6.1 |
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) | Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) |
| n/a | Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) | Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions) |
Timeline
- Dec 8, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- May 24, 2022 CVE Updated
- Jun 2, 2026 Security Advisory
- Aug 29, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-7540
vulnetix vdb fixes CVE-2020-7540Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-7540/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart