VulnerabilityModified
CVE-2020-7533
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
CRITICAL 9.8EPSS 2.34%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 2.34% probability · 83th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- schneider-electric/modicon m340 bmxp3420302 firmware · schneider-electric/modicon m340 bmxp342000 firmware · schneider-electric/modicon m340 bmxp341000 firmware · schneider-electric/modicon m340 bmxp3420102 firmware · schneider-electric/bmxnoe0100 firmware · schneider-electric/bmxnoe0110 firmware · schneider-electric/bmxnoc0401 firmware · schneider-electric/tsxp574634 firmware · schneider-electric/tsxp575634 firmware · schneider-electric/tsxp576634 firmware · schneider-electric/tsxety4103 firmware · schneider-electric/tsxety5103 firmware · schneider-electric/140noe77111 firmware · schneider-electric/140noc78000 firmware · schneider-electric/140noc77101 firmware · schneider-electric/140cpu65260 firmware
- Source
- cybersecurity@se.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.