Sign-up

ID

VAR-202011-1274


CVE

CVE-2020-7563


TITLE

plural  Modicon  Out-of-bounds write vulnerabilities in the product

Trust: 0.8

sources: JVNDB: JVNDB-2020-013777

DESCRIPTION

A CWE-787: Out-of-bounds Write vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP. plural Modicon The product contains a vulnerability related to out-of-bounds writing.Information is obtained, information is tampered with, and service is disrupted (DoS) It may be put into a state

Trust: 1.71

sources: NVD: CVE-2020-7563 // JVNDB: JVNDB-2020-013777 // VULMON: CVE-2020-7563

AFFECTED PRODUCTS

vendor:schneider electricmodel:modicon tsxp574634scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx nor 0200hscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon tsxety4103scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon tsxp575634scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65150scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon tsxp576634scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65160cscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx noe 0110hscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx p34-2030scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx noe 0100hscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx noe 0110scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon tsxety5103scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65150cscope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx p34-2010scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx noc 0401scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140noe77111scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140noc78100scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140noe77101scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon m340 bmx noe 0100scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140cpu65160scope:eqversion:*

Trust: 1.0

vendor:schneider electricmodel:modicon quantum 140noc78100scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon quantum 140noe77111scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon tsxety5103scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon quantum 140cpu65150scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon tsxp575634scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon tsxp574634scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon tsxp576634scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon tsxety4103scope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon quantum 140cpu65150cscope: - version: -

Trust: 0.8

vendor:schneider electricmodel:modicon quantum 140noe77101scope: - version: -

Trust: 0.8

sources: JVNDB: JVNDB-2020-013777 // NVD: CVE-2020-7563

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2020-7563
value: HIGH

Trust: 1.8

CNNVD: CNNVD-202011-1644
value: HIGH

Trust: 0.6

VULMON: CVE-2020-7563
value: MEDIUM

Trust: 0.1

VULMON: CVE-2020-7563
severity: MEDIUM
baseScore: 6.5
vectorString: AV:N/AC:L/AU:S/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

NVD: CVE-2020-7563
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 2.8
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2020-7563
baseSeverity: HIGH
baseScore: 8.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULMON: CVE-2020-7563 // JVNDB: JVNDB-2020-013777 // CNNVD: CNNVD-202011-1644 // NVD: CVE-2020-7563

PROBLEMTYPE DATA

problemtype:CWE-787

Trust: 1.0

problemtype:Out-of-bounds writing (CWE-787) [ Other ]

Trust: 0.8

sources: JVNDB: JVNDB-2020-013777 // NVD: CVE-2020-7563

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202011-1644

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-202011-1644

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2020-7563

PATCH
title:SEVD-2020-315-01url:https://www.se.com/ww/en/download/document/sevd-2020-315-01/
Trust: 0.8
title:Multiple Schneider Electric Product Buffer Error Vulnerability Fixurl:http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=135773
Trust: 0.6
title:Fortinet Security Advisories: Fortinet Discovers Schneider Electric Modicon Embedded HTTP Server Out-Of-Bounds Write Vulnerabilityurl:https://vulmon.com/vendoradvisory?qidtp=fortinet_security_advisories&qid=fg-vd-20-106
Trust: 0.1
sources:
            
            
            VULMON: CVE-2020-7563 // 
            
            
            
            JVNDB: JVNDB-2020-013777 // 
            
            
            
            CNNVD: CNNVD-202011-1644

EXTERNAL IDS
db:NVDid:CVE-2020-7563
Trust: 2.5
db:SCHNEIDERid:SEVD-2020-315-01
Trust: 1.7
db:JVNid:JVNVU91241691
Trust: 0.8
db:JVNDBid:JVNDB-2020-013777
Trust: 0.8
db:AUSCERTid:ESB-2021.0049
Trust: 0.6
db:ICS CERTid:ICSA-21-005-01
Trust: 0.6
db:CNNVDid:CNNVD-202011-1644
Trust: 0.6
db:VULMONid:CVE-2020-7563
Trust: 0.1
sources:
            
            
            VULMON: CVE-2020-7563 // 
            
            
            
            JVNDB: JVNDB-2020-013777 // 
            
            
            
            CNNVD: CNNVD-202011-1644 // 
            
            
            
            NVD: CVE-2020-7563

REFERENCES
url:https://www.se.com/ww/en/download/document/sevd-2020-315-01/
Trust: 1.7
url:https://nvd.nist.gov/vuln/detail/cve-2020-7563
Trust: 1.4
url:https://jvn.jp/vu/jvnvu91241691/
Trust: 0.8
url:https://www.auscert.org.au/bulletins/esb-2021.0049/
Trust: 0.6
url:https://us-cert.cisa.gov/ics/advisories/icsa-21-005-01
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/787.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://fortiguard.com/zeroday/fg-vd-20-106
Trust: 0.1
sources:
            
            
            VULMON: CVE-2020-7563 // 
            
            
            
            JVNDB: JVNDB-2020-013777 // 
            
            
            
            CNNVD: CNNVD-202011-1644 // 
            
            
            
            NVD: CVE-2020-7563

SOURCES
db:VULMONid:CVE-2020-7563
db:JVNDBid:JVNDB-2020-013777
db:CNNVDid:CNNVD-202011-1644
db:NVDid:CVE-2020-7563

LAST UPDATE DATE
2022-05-04T09:15:37.799000+00:00

SOURCES UPDATE DATE
db:VULMONid:CVE-2020-7563date:2020-12-02T00:00:00
db:JVNDBid:JVNDB-2020-013777date:2021-07-13T07:59:00
db:CNNVDid:CNNVD-202011-1644date:2022-03-10T00:00:00
db:NVDid:CVE-2020-7563date:2020-12-02T21:09:00

SOURCES RELEASE DATE
db:VULMONid:CVE-2020-7563date:2020-11-18T00:00:00
db:JVNDBid:JVNDB-2020-013777date:2021-07-13T00:00:00
db:CNNVDid:CNNVD-202011-1644date:2020-11-18T00:00:00
db:NVDid:CVE-2020-7563date:2020-11-18T14:15:00