Vulnerability in Schneider-Electric Ecostruxure Control Expert
CVE-2020-7475
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), reflective DLL, vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10), which, if exploited, could allow attackers to transfer malicious code to the controller.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.016 (74.5th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 74.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: 0.000
Affected products
- Schneider-Electric Ecostruxure Control Expert
- Schneider-Electric Modicon M340
- Schneider-Electric Modicon M340 Firmware
- Schneider-Electric Modicon M580
- Schneider-Electric Modicon M580 Firmware
- Schneider-Electric Unity Pro
- Ecostruxure Control Expert (All Versions Prior To 14.1 Hot Fix), Unity Pro Versions), Modicon M340 V3.20), M580 V3.10) — versions EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20), Modicon M580 (all versions prior to V3.10)
Weakness classification (CWE)
References
- www.se.com/ww/en/download/document/SEVD-2020-080-01 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7475?
- CVE-2020-7475 is a critical-severity vulnerability in Schneider-Electric Ecostruxure Control Expert, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 9.8/10. Published 2020-03-23.
- How severe is CVE-2020-7475?
- Critical severity. CVSS v3 base score is 9.8 out of 10.