← Vulnerability feed

Vulnerability record · CVE-2020-28220 · published 11 December 2020

CVE-2020-28220: Schneider-electric modicon m258 firmware memory buffer overflow vulnerability

Schneider Electric · Modicon M258 Firmware

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions), that could cause a buffer overflow when the length of a file transferred to the webserver is not verified.

6.8 CVSS 3.1 Medium EPSS 1.1% · top 36.8% CWE-119 · Memory buffer overflow
6.8CVSS 3.1 base score, v2 5.2
1.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
3Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior to V5.0.4.11) and SoMachine/SoMachine Motion software (All versions), that could cause a buffer overflow when the length of a file transferred to the webserver is not verified.

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.se.com/ww/en/download/document/SEVD-2020-343-09/ Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-343-09/ Vendor Advisory

Track CVE-2020-28220 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-7487Schneider-electric ecostruxure machine expert insufficient verification of data authenticity vulnerabilityA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modico…EPSS 0.69%9.8CVE-2017-7574Schneider-electric modicon tm221ce16r firmware hard-coded credentials vulnerabilitySchneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project …EPSS 1.3%9.3CVE-2013-0662Schneider-electric concept out-of-bounds write vulnerabilityMultiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute …EPSS 22%8.8CVE-2017-7966Schneider-electric somachine uncontrolled search path element vulnerabilityA DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary…EPSS 2.4%8.2CVE-2019-6820Schneider-electric modicon m100 firmware missing authentication for critical function vulnerabilityA CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address,…EPSS 1.3%7.5CVE-2020-7488Schneider-electric ecostruxure machine expert cleartext transmission vulnerabilityA CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the softwa…EPSS 0.88%7.5CVE-2014-9200Schneider-electric somachine stack-based buffer overflow vulnerabilityStack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modb…EPSS 5.6%6.1CVE-2024-6528Schneider-electric modicon m241 firmware cross-site scripting vulnerabilityCWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability le…EPSS 0.26%

Source: NIST National Vulnerability Database (record CVE-2020-28220), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.