What’s Vulnerable › Vulnerabilities

CVE-2020-7533

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-12-01 · updated 2026-06-17
• Weakness: CWE-287

Description

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

Affected products

• Schneider-Electric 140Cpu65260 Firmware: before 6.1 — fixed in 6.1
• Schneider-Electric 140Noc77101 Firmware: before 1.08 — fixed in 1.08
• Schneider-Electric 140Noc78000 Firmware: before 1.74 — fixed in 1.74
• Schneider-Electric 140Noe77111 Firmware: before 7.1 — fixed in 7.1
• Schneider-Electric Bmxnoc0401 Firmware: before 2.10 — fixed in 2.10
• Schneider-Electric Bmxnoe0100 Firmware: before 3.3 — fixed in 3.3
• Schneider-Electric Bmxnoe0110 Firmware: before 6.5 — fixed in 6.5
• Schneider-Electric Modicon M340 Bmxp341000 Firmware: before 3.20 — fixed in 3.20
• Schneider-Electric Modicon M340 Bmxp342000 Firmware: before 3.20 — fixed in 3.20
• Schneider-Electric Modicon M340 Bmxp3420102 Firmware: before 3.20 — fixed in 3.20
• Schneider-Electric Modicon M340 Bmxp3420302 Firmware: before 3.20 — fixed in 3.20
• Schneider-Electric Tsxety4103 Firmware: before 6.2 — fixed in 6.2
• Schneider-Electric Tsxety5103 Firmware: before 6.4 — fixed in 6.4
• Schneider-Electric Tsxp574634 Firmware: before 6.1 — fixed in 6.1
• Schneider-Electric Tsxp575634 Firmware: before 6.1 — fixed in 6.1
• Schneider-Electric Tsxp576634 Firmware: before 6.1 — fixed in 6.1

How to fix

Upgrade to a fixed version: Schneider-Electric 140Cpu65260 Firmware 6.1; Schneider-Electric 140Noc77101 Firmware 1.08; Schneider-Electric 140Noc78000 Firmware 1.74; Schneider-Electric 140Noe77111 Firmware 7.1; Schneider-Electric Bmxnoc0401 Firmware 2.10; Schneider-Electric Bmxnoe0100 Firmware 3.3; Schneider-Electric Bmxnoe0110 Firmware 6.5; Schneider-Electric Modicon M340 Bmxp341000 Firmware 3.20; Schneider-Electric Modicon M340 Bmxp342000 Firmware 3.20; Schneider-Electric Modicon M340 Bmxp3420102 Firmware 3.20; Schneider-Electric Modicon M340 Bmxp3420302 Firmware 3.20; Schneider-Electric Tsxety4103 Firmware 6.2. Check the vendor advisory for mitigations.

References

• https://download.schneider-electric.com/files?p_File_Name=SEVD-2020-287-01_Modicon_Web_Server_Security_Notificatiton.pdf&p_Doc_Ref=SEVD-2020-287-01&p_enDocType=Security+and+Safety+Notice
• https://www.se.com/ww/en/download/document/SEVD-2020-287-01/

Get alerted when CVE-2020-7533 or the next vulnerability affects your stack