CVE-2020-7564: Schneider Electric Modicon m340 Bmx Noc 0401 Firmware

High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days.

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists in the Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules (see notification for details) which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.

Affected products

• Schneider Electric Modicon m340 Bmx Noc 0401 Firmware: any version
• Schneider Electric Modicon m340 Bmx Noe 0100 Firmware: any version
• Schneider Electric Modicon m340 Bmx Noe 0100h Firmware: any version
• Schneider Electric Modicon m340 Bmx Noe 0110 Firmware: any version
• Schneider Electric Modicon m340 Bmx Noe 0110h Firmware: any version
• Schneider Electric Modicon m340 Bmx Nor 0200h Firmware: any version
• Schneider Electric Modicon m340 Bmx p34-2010 Firmware: any version
• Schneider Electric Modicon m340 Bmx p34-2030 Firmware: any version
• Schneider Electric Modicon Quantum 140cpu65150 Firmware: any version
• Schneider Electric Modicon Quantum 140cpu65150c Firmware: any version
• Schneider Electric Modicon Quantum 140cpu65160 Firmware: any version
• Schneider Electric Modicon Quantum 140cpu65160c Firmware: any version
• Schneider Electric Modicon Quantum 140noc78100 Firmware: any version
• Schneider Electric Modicon Quantum 140noe77101 Firmware: any version
• Schneider Electric Modicon Quantum 140noe77111 Firmware: any version
• Schneider Electric Modicon TSXETY4103 Firmware: any version
• Schneider Electric Modicon TSXETY5103 Firmware: any version
• Schneider Electric Modicon TSXP574634 Firmware: any version
• Schneider Electric Modicon TSXP575634 Firmware: any version
• Schneider Electric Modicon TSXP576634 Firmware: any version

Published 2020-11-18. Last modified 2026-06-17.