CVE-2020-7540
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary commands on Schneider Electric Modicon PLCs via specially crafted HTTP requests. It affects Modicon M340, Quantum, and Premium PLCs and associated communication modules. Attackers can gain full control of industrial controllers without any authentication.
💻 Affected Systems
- Modicon M340
- Modicon Quantum
- Modicon Premium
- Associated Communication Modules
📦 What is this software?
140cpu65150 Firmware by Schneider Electric
140cpu65160 Firmware by Schneider Electric
140noc77101 Firmware by Schneider Electric
140noc78000 Firmware by Schneider Electric
140noc78100 Firmware by Schneider Electric
140noe77101 Firmware by Schneider Electric
140noe77111 Firmware by Schneider Electric
Bmxnoc0401 Firmware by Schneider Electric
Bmxnoe0100 Firmware by Schneider Electric
Bmxnoe0110 Firmware by Schneider Electric
Bmxnor200h Firmware by Schneider Electric
Modicon M340 Bmxp341000 Firmware by Schneider Electric
Modicon M340 Bmxp342000 Firmware by Schneider Electric
Modicon M340 Bmxp3420102 Firmware by Schneider Electric
Modicon M340 Bmxp3420102cl Firmware by Schneider Electric
View all CVEs affecting Modicon M340 Bmxp3420102cl Firmware →
Modicon M340 Bmxp342020 Firmware by Schneider Electric
Modicon M340 Bmxp3420302 Firmware by Schneider Electric
Modicon M340 Bmxp3420302cl Firmware by Schneider Electric
View all CVEs affecting Modicon M340 Bmxp3420302cl Firmware →
Tsxety4103 Firmware by Schneider Electric
Tsxety5103 Firmware by Schneider Electric
Tsxp574634 Firmware by Schneider Electric
Tsxp575634 Firmware by Schneider Electric
Tsxp576634 Firmware by Schneider Electric
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial control systems leading to physical damage, production shutdown, safety system manipulation, or environmental harm.
Likely Case
Unauthorized command execution allowing attackers to modify PLC logic, disrupt operations, steal sensitive industrial data, or establish persistence in OT networks.
If Mitigated
Limited impact if controllers are isolated behind firewalls with strict network segmentation and access controls.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests to the vulnerable web server. No authentication or special privileges needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Firmware updates specified in Schneider Electric security notification
Vendor Advisory: https://www.se.com/ww/en/download/document/SEVD-2020-343-04/
Restart Required: Yes
Instructions:
1. Download firmware updates from Schneider Electric website. 2. Backup current PLC configuration. 3. Apply firmware update following vendor instructions. 4. Restart PLC. 5. Verify update and restore configuration if needed.
🔧 Temporary Workarounds
Network Segmentation
allIsolate PLCs in separate network segments with strict firewall rules blocking HTTP access from untrusted networks.
Access Control Lists
allImplement IP-based access restrictions to only allow authorized engineering stations to communicate with PLC web interfaces.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate PLCs from untrusted networks
- Deploy industrial firewalls with deep packet inspection to block malicious HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check firmware version against affected versions list in Schneider Electric advisory. Test with authorized vulnerability scanner.Check Version:
Check PLC firmware version through engineering software (Unity Pro, Control Expert) or web interfaceVerify Fix Applied:
Verify firmware version has been updated to patched version. Test with vulnerability scanner to confirm HTTP command execution is no longer possible.📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP requests to PLC web interface
- Multiple failed authentication attempts followed by command execution
- Changes to PLC logic or configuration without authorized change records
Network Indicators:
- HTTP requests with unusual patterns or command injection attempts to PLC IP addresses
- Traffic from unexpected sources to PLC web ports
SIEM Query:
source_ip=* AND dest_port=80 OR dest_port=8080 AND (http_uri CONTAINS "command" OR http_uri CONTAINS "exec" OR http_method="POST" with unusual payloads)