CVE-2020-7491

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-07-23 · updated 2026-06-17

Description

**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network and could allow inappropriate access. This vulnerability was remediated in TCM version 10.5.4.

Affected products

Schneider-Electric Tricon Tcm 4351 Firmware: from 10.2.0 before 10.5.4 — fixed in 10.5.4
Schneider-Electric Tricon Tcm 4351A Firmware: from 10.2.0 before 10.5.4 — fixed in 10.5.4
Schneider-Electric Tricon Tcm 4351B Firmware: from 10.2.0 before 10.5.4 — fixed in 10.5.4
Schneider-Electric Tricon Tcm 4352 Firmware: from 10.2.0 before 10.5.4 — fixed in 10.5.4
Schneider-Electric Tricon Tcm 4352A Firmware: from 10.2.0 before 10.5.4 — fixed in 10.5.4
Schneider-Electric Tricon Tcm 4352B Firmware: from 10.2.0 before 10.5.4 — fixed in 10.5.4
Schneider-Electric Tristation 1131 Firmware: from 1.0.0 through 4.9.0; from 4.10.0 through 4.12.0

How to fix

Upgrade to a fixed version: Schneider-Electric Tricon Tcm 4351 Firmware 10.5.4; Schneider-Electric Tricon Tcm 4351A Firmware 10.5.4; Schneider-Electric Tricon Tcm 4351B Firmware 10.5.4; Schneider-Electric Tricon Tcm 4352 Firmware 10.5.4; Schneider-Electric Tricon Tcm 4352A Firmware 10.5.4; Schneider-Electric Tricon Tcm 4352B Firmware 10.5.4. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-7491 or the next vulnerability affects your stack