Vulnerability in Schneider-Electric OS Loader
CVE-2020-7498
A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.014 (70.6th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 71st percentile — 70.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.014 · newest: 0.014 · change: 0.000
Affected products
- Schneider-Electric OS Loader
- Schneider-Electric Unity Loader
- Unity Loader And OS Software (All Versions) — versions Unity Loader and OS Loader Software (All versions)
Weakness classification (CWE)
References
- www.se.com/ww/en/download/document/SEVD-2020-161-02 (Vendor Advisory)
Frequently asked questions
- What is CVE-2020-7498?
- CVE-2020-7498 is a critical-severity vulnerability in Schneider-Electric OS Loader, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2020-06-16.
- How severe is CVE-2020-7498?
- Critical severity. CVSS v3 base score is 9.8 out of 10.