CVE-2020-7533
A CWE-255: Credentials Management vulnerability exists in Web Server on Modicon M340, Modicon...
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
- Record
CVE-2020-7533- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-287
- Updated
- 2026-11-02
CVE List No score
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
- Record
CVE-2020-7533- Weakness
- CWE-287
- Updated
- 2026-11-02
EUVDEUVD-2020-28658 No score
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
- Record
EUVD-2020-28658- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-4wm4-5vmp-66g7
A CWE-255: Credentials Management vulnerability exists in Web Server on Modicon M340, Modicon...
A CWE-255: Credentials Management vulnerability exists in Web Server on Modicon M340, Modicon Quantum and ModiconPremium Legacy offers and their Communication Modules (see security notification for version information) which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
- Record
GHSA-4wm4-5vmp-66g7- CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-287
- Updated
- 2026-11-02
Affected products
- schneider-electric 140cpu65260 firmware
- schneider-electric 140noc77101 firmware
- schneider-electric 140noc78000 firmware
- schneider-electric 140noe77111 firmware
- schneider-electric bmxnoc0401 firmware
- schneider-electric bmxnoe0100 firmware
- schneider-electric bmxnoe0110 firmware
- schneider-electric modicon m340 bmxp341000 firmware
- schneider-electric modicon m340 bmxp342000 firmware
- schneider-electric modicon m340 bmxp3420102 firmware
- schneider-electric modicon m340 bmxp3420302 firmware
- schneider-electric tsxety4103 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7533 is a critical vulnerability (CVSS 9.8) in Schneider-electric 140cpu65260 Firmware, published December 1, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.34%, the 83rd percentile. No source names a fixed version.
References
download.schneider-electric.com/files?p_File_Name=SEVD-2020-287-01_Modicon_Web_Server_Security_Notificatiton.pdf&p_Doc_Ref=SEVD-2020-287-01&p_enDocType=Security+and+Safety+Notice
se.com/ww/en/download/document/SEVD-2020-287-01
nvd.nist.gov/vuln/detail/CVE-2020-7533
github.com/advisories/GHSA-4wm4-5vmp-66g7