Schneider Electric TSXETY4103 Firmware vulnerabilities

11 CVEs affecting Schneider Electric TSXETY4103 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-22788, published 2022-02-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0754, published 2014-10-03. High severity, CVSS 10.0. EPSS: 9.5% chance of exploitation in the next 30 days. Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401…
CVE-2020-7533, published 2020-12-01. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.
CVE-2020-7540, published 2020-12-11. Critical severity, CVSS 9.8. EPSS: 2.3% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules…
CVE-2020-7535, published 2020-12-11. High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days. A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and…
CVE-2020-7539, published 2020-12-11. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication…
CVE-2020-7549, published 2020-12-11. Medium severity, CVSS 5.3. EPSS: 1.1% chance of exploitation in the next 30 days. A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication…
CVE-2021-22788, published 2022-02-11. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP request to the web server of the device. Affected Product:…
CVE-2021-22787, published 2022-02-11. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request to the web server of the device.…
CVE-2021-22785, published 2022-02-11. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. A CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when an attacker sends a HTTP request to the web server…
CVE-2020-7541, published 2020-12-11. Medium severity, CVSS 5.3. EPSS: 0.9% chance of exploitation in the next 30 days. A CWE-425: Direct Request ('Forced Browsing') vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see…

Latest

CVE-2020-7534, published 2022-02-04. High severity, CVSS 8.8. EPSS: 0.4% chance of exploitation in the next 30 days. A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user…