CVEvulnerability

CVE-2020-7475

9.8 CRITICAL Published 2020-03-23 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2020-03-23
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-74

Description

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller.

Affected configurations

• schneider-electric ecostruxure control expert (<= 14.0) • schneider-electric unity pro • schneider-electric modicon m340 firmware (< 3.20) • schneider-electric modicon m580 firmware (< 3.10)

Related

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References