CVE-2014-0754
Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.98%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 8.98% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- schneider-electric/stbnic2212 firmware · schneider-electric/stbnip2212 firmware · schneider-electric/tsxetc0101 firmware · schneider-electric/tsxetc100 firmware · schneider-electric/tsxp573623mc firmware · schneider-electric/tsxety110ws firmware · schneider-electric/tsxp574634m firmware · schneider-electric/tsxety110wsc firmware · schneider-electric/tsxp574823am firmware · schneider-electric/tsxety4103 firmware · schneider-electric/tsxp574823m firmware · schneider-electric/tsxety4103c firmware · schneider-electric/tsxp574823mc firmware · schneider-electric/tsxety5103 firmware · schneider-electric/tsxp575634m firmware · schneider-electric/tsxety5103c firmware · schneider-electric/tsxp576634m firmware · schneider-electric/tsxetz410 firmware · schneider-electric/tsxwmy100 firmware · schneider-electric/tsxetz510 firmware · +23 more
- Source
- ics-cert@hq.dhs.gov
References
- http://www.securityfocus.com/bid/70193Third Party Advisory, VDB Entry
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2014-260-01
- https://www.cisa.gov/news-events/ics-advisories/icsa-14-273-01
- http://download.schneider-electric.com/files?p_Reference=SEVD-2014-260-01&p_EnDocType=Software%20-%20Updates&p_File_Id=608959359&p_File_Name=SEVD-2014-260-01.pdfPatch, Vendor Advisory
- http://www.securityfocus.com/bid/70193Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-14-273-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.