Resource exhaustion in Schneider-Electric Tricon Tcm 4351
CVE-2020-7486
**VERSION NOT SUPPORTED WHEN ASSIGNED** A vulnerability could cause TCM modules to reset when under high network load in TCM v10.4.x and in system v10.3.x. This vulnerability was discovered and remediated in version v10.5.x on August 13, 2009. TCMs from v10.5.x and on will no longer exhibit this behavior.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.016 (75.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 75th percentile — 75.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.016 · newest: 0.016 · change: +0.000
Affected products
- Schneider-Electric Tricon Tcm 4351
- Schneider-Electric Tricon Tcm 4351a
- Schneider-Electric Tricon Tcm 4351a Firmware — versions 10.3.x, 10.4.x
- Schneider-Electric Tricon Tcm 4351b
- Schneider-Electric Tricon Tcm 4351b Firmware — versions 10.3.x, 10.4.x
- Schneider-Electric Tricon Tcm 4351 Firmware — versions 10.3.x, 10.4.x
- Schneider-Electric Tricon Tcm 4352
- Schneider-Electric Tricon Tcm 4352a
- Schneider-Electric Tricon Tcm 4352a Firmware — versions 10.3.x, 10.4.x
- Schneider-Electric Tricon Tcm 4352b
Weakness classification (CWE)
References
- www.se.com/ww/en/download/document/SESB-2020-105-01 (Vendor Advisory)
- us-cert.cisa.gov/ics/advisories/icsa-20-205-01 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-7486?
- CVE-2020-7486 is a high-severity vulnerability in Schneider-Electric Tricon Tcm 4351, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2020-04-16.
- How severe is CVE-2020-7486?
- High severity. CVSS v3 base score is 7.5 out of 10.