CVE-2020-7564
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability...
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
- Record
CVE-2020-7564- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-120
- Updated
- 2026-11-02
CVE List
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
- Record
CVE-2020-7564- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
EUVDEUVD-2020-28689
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
- Record
EUVD-2020-28689- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m8xw-66cv-rfr6
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability...
A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.
- Record
GHSA-m8xw-66cv-rfr6- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-120
- Updated
- 2026-11-02
Affected products
- schneider-electric modicon m340 bmx noc 0401 firmware
- schneider-electric modicon m340 bmx noe 0100 firmware
- schneider-electric modicon m340 bmx noe 0100h firmware
- schneider-electric modicon m340 bmx noe 0110 firmware
- schneider-electric modicon m340 bmx noe 0110h firmware
- schneider-electric modicon m340 bmx nor 0200h firmware
- schneider-electric modicon m340 bmx p34-2010 firmware
- schneider-electric modicon m340 bmx p34-2030 firmware
- schneider-electric modicon quantum 140cpu65150 firmware
- schneider-electric modicon quantum 140cpu65150c firmware
- schneider-electric modicon quantum 140cpu65160 firmware
- schneider-electric modicon quantum 140cpu65160c firmware
Show 8 moreShow less
- schneider-electric modicon quantum 140noc78100 firmware
- schneider-electric modicon quantum 140noe77101 firmware
- schneider-electric modicon quantum 140noe77111 firmware
- schneider-electric modicon tsxety4103 firmware
- schneider-electric modicon tsxety5103 firmware
- schneider-electric modicon tsxp574634 firmware
- schneider-electric modicon tsxp575634 firmware
- schneider-electric modicon tsxp576634 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7564 is a high vulnerability (CVSS 8.8) in Schneider-electric Modicon M340 Bmx Noc 0401 Firmware, published November 18, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.18%, the 67th percentile. No source names a fixed version.