CVE-2020-7491: Schneider Electric Tricon Tcm 4351 Firmware

High severity, CVSS 7.5. EPSS: 1.3% chance of exploitation in the next 30 days.

**VERSION NOT SUPPORTED WHEN ASSIGNED** A legacy debug port account in TCMs installed in Tricon system versions 10.2.0 through 10.5.3 is visible on the network and could allow inappropriate access. This vulnerability was remediated in TCM version 10.5.4.

Affected products

• Schneider Electric Tricon Tcm 4351 Firmware: from 10.2.0, before 10.5.4 (fixed in 10.5.4)
• Schneider Electric Tricon Tcm 4351a Firmware: from 10.2.0, before 10.5.4 (fixed in 10.5.4)
• Schneider Electric Tricon Tcm 4351b Firmware: from 10.2.0, before 10.5.4 (fixed in 10.5.4)
• Schneider Electric Tricon Tcm 4352 Firmware: from 10.2.0, before 10.5.4 (fixed in 10.5.4)
• Schneider Electric Tricon Tcm 4352a Firmware: from 10.2.0, before 10.5.4 (fixed in 10.5.4)
• Schneider Electric Tricon Tcm 4352b Firmware: from 10.2.0, before 10.5.4 (fixed in 10.5.4)
• Schneider Electric Tristation 1131 Firmware: from 1.0.0, up to and including 4.9.0; from 4.10.0, up to and including 4.12.0

Published 2020-07-23. Last modified 2026-06-17.