CVE-2020-7540

EPSS 2.1%CWE-306

Vexday Risk Score

3Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS —EPSS 2.1%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

11 Dec 2020Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause unauthenticated command execution in the controller when sending special HTTP requests.

Affected products

n/a · Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions)

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://www.se.com/ww/en/download/document/SEVD-2020-343-04/