#VU49331 Out-of-bounds write in Schneider Electric products - CVE-2020-7563

Vulnerability identifier: #VU49331

Vulnerability risk: Medium

CVSSv4.0: 5.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2020-7563

CWE-ID: CWE-787

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
BMX P34x
Hardware solutions / Firmware
BMX NOE 0100 (H)
Hardware solutions / Firmware
BMX NOE 0110 (H)
Hardware solutions / Firmware
BMX NOC 0401
Hardware solutions / Firmware
BMX NOR 0200H
Hardware solutions / Firmware
TSXP574634
Hardware solutions / Firmware
TSXP575634
Hardware solutions / Firmware
TSXP576634
Hardware solutions / Firmware
TSXETY4103
Hardware solutions / Firmware
TSXETY5103
Hardware solutions / Firmware
140CPU65xxxxx
Hardware solutions / Firmware
140NOE771x1
Hardware solutions / Firmware
140NOC78x00
Hardware solutions / Firmware
140NOC77101
Hardware solutions / Firmware

Vendor: Schneider Electric

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when uploading a specially crafted file on the controller over FTP. A remote authenticated attacker can trigger out-of-bounds write and execute arbitrary code on the target system.

This vulnerability affects the following Modicon products:

• M340 CPUs
  • BMX P34x, all versions
• M340 Communication Ethernet modules
  • BMX NOE 0100 (H), all versions
  • BMX NOE 0110 (H), all versions
  • BMX NOC 0401, all versions
  • BMX NOR 0200H, all versions
• Premium processors with integrated Ethernet COPRO
  • TSXP574634, TSXP575634, TSXP576634, all versions
• Premium communication modules
  • TSXETY4103, all versions
  • TSXETY5103, all versions
• Quantum processors with integrated Ethernet COPRO
  • 140CPU65xxxxx, all versions
• Quantum communication modules
  • 140NOE771x1, all versions
  • 140NOC78x00, all versions
  • 140NOC77101, all versions

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

BMX P34x: All versions

BMX NOE 0100 (H): All versions

BMX NOE 0110 (H): All versions

BMX NOC 0401: All versions

BMX NOR 0200H: All versions

TSXP574634: All versions

TSXP575634: All versions

TSXP576634: All versions

TSXETY4103: All versions

TSXETY5103: All versions

140CPU65xxxxx: All versions

140NOE771x1: All versions

140NOC78x00: All versions

140NOC77101: All versions

---

External links
https://www.se.com/ww/en/download/document/SEVD-2020-315-01/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.