What is CVE-2020-7498?

CVE-2020-7498 is a critical-severity vulnerability in Schneider-Electric OS Loader, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2020-06-16.

How severe is CVE-2020-7498?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Vulnerability in Schneider-Electric OS Loader

CVE-2020-7498

A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.

EPSS: 0.014 (68.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Schneider-electric Os_loader
Schneider-electric Unity_loader
N/a Unity Loader And Os Software (All Versions) — versions Unity Loader and OS Loader Software (All versions)

Weakness classification (CWE)

CWE-798 — Use of Hard-coded Credentials

References

cybersecurity@se.com (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2020-7498?: CVE-2020-7498 is a critical-severity vulnerability in Schneider-Electric OS Loader, classified under Use of Hard-coded Credentials. CVSS score: 9.8/10. Published 2020-06-16.
How severe is CVE-2020-7498?: Critical severity. CVSS v3 base score is 9.8 out of 10.