← Vulnerability feed

Vulnerability record · CVE-2020-7489 · published 22 April 2020

CVE-2020-7489: Schneider-electric ecostruxure machine expert injection vulnerability

Schneider Electric · Ecostruxure Machine Expert

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller.

9.8 CVSS 3.1 Critical EPSS 1.6% · top 25.2% CWE-74 · Injection
9.8CVSS 3.1 base score, v2 7.5
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
5Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming software (versions in security notification). The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.se.com/ww/en/download/document/SEVD-2020-105-01 PatchVendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-105-01 PatchVendor Advisory

Track CVE-2020-7489 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-7487Schneider-electric ecostruxure machine expert insufficient verification of data authenticity vulnerabilityA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modico…EPSS 0.69%9.8CVE-2018-7790Schneider-electric modicon m221 firmware authentication bypass by capture-replay vulnerabilityAn Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.…EPSS 2.5%9.8CVE-2018-7791Schneider-electric modicon m221 firmware improper authentication vulnerabilityA Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior t…EPSS 1.9%9.1CVE-2021-22704Schneider-electric vijeo designer path traversal vulnerabilityA CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Harmony/HMI Products Configured by Vijeo Designer (all …EPSS 1.3%8.2CVE-2019-6820Schneider-electric modicon m100 firmware missing authentication for critical function vulnerabilityA CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address,…EPSS 1.3%8.2CVE-2018-7798Schneider-electric somachine basic insufficient verification of data authenticity vulnerabilityA Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4…EPSS 0.66%7.8CVE-2021-22705Schneider-electric vijeo designer memory buffer overflow vulnerabilityImproper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause denial of service or unauthorized acces…EPSS 0.25%7.5CVE-2020-7488Schneider-electric ecostruxure machine expert cleartext transmission vulnerabilityA CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the softwa…EPSS 0.88%

Source: NIST National Vulnerability Database (record CVE-2020-7489), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.