← Vulnerability feed

Vulnerability record · CVE-2020-7534 · published 4 February 2022

CVE-2020-7534: Schneider-electric modicon m340 bmxp342020 firmware cross-site request forgery vulnerability

Schneider Electric · Modicon M340 Bmxp342020 Firmware

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions), Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions), Modicon M340 ethernet modules: (BMXNOC0401, BMXNOE01, BMXNOR0200H) (All Versions), Modicon Quantum and Premium factory cast communication modules: (140NOE77111, 140NOC78*00, TSXETY5103, TSXETY4103) (All Versions)

8.8 CVSS 3.1 High EPSS 0.36% · top 73.0% CWE-352 · Cross-site request forgery
8.8CVSS 3.1 base score, v2 6.8
0.36%EPSS exploitation probability, 30 days
NoNot in CISA KEV
10Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server used, that could cause a leak of sensitive data or unauthorized actions on the web server during the time the user is logged in. Affected Products: Modicon M340 CPUs: BMXP34 (All Versions), Modicon Quantum CPUs with integrated Ethernet (Copro): 140CPU65 (All Versions), Modicon Premium CPUs with integrated Ethernet (Copro): TSXP57 (All Versions), Modicon M340 ethernet modules: (BMXNOC0401, BMXNOE01, BMXNOR0200H) (All Versions), Modicon Quantum and Premium factory cast communication modules: (140NOE77111, 140NOC78*00, TSXETY5103, TSXETY4103) (All Versions)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

10 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01 PatchVendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-01 PatchVendor Advisory

Track CVE-2020-7534 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-7540Schneider-electric modicon m340 bmxp341000 firmware missing authentication for critical function vulnerabilityA CWE-306: Missing Authentication for Critical Function vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Mod…EPSS 2.3%9.8CVE-2020-7533Schneider-electric modicon m340 bmxp3420302 firmware improper authentication vulnerabilityCWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sendin…EPSS 2.3%7.5CVE-2021-22787Schneider-electric modicon m340 bmxp342020 firmware improper input validation vulnerabilityA CWE-20: Improper Input Validation vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted …EPSS 1.0%7.5CVE-2021-22788Schneider-electric modicon m340 bmxp342020 firmware out-of-bounds write vulnerabilityA CWE-787: Out-of-bounds Write vulnerability exists that could cause denial of service when an attacker sends a specially crafted HTTP request to the…EPSS 1.0%7.5CVE-2021-22785Schneider-electric modicon m340 bmxp342020 firmware information exposure vulnerabilityA CWE-200: Information Exposure vulnerability exists that could cause sensitive information of files located in the web root directory to leak when a…EPSS 0.96%7.5CVE-2020-7535Schneider-electric modicon m340 bmxp341000 firmware path traversal vulnerabilityA CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type) vulnerability exists in the Web Server on…EPSS 1.5%7.5CVE-2020-7539Schneider-electric modicon m340 bmxp341000 firmware vulnerabilityA CWE-754 Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum …EPSS 1.2%7.5CVE-2020-7477Schneider-electric 140noe77101 firmware vulnerabilityA CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (Versions 7.0 and…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2020-7534), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.