CVE-2014-0754

Summary

Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.

Affected Software

Weaknesses

• n/a

Workarounds

Search downloads for SEVD-14-260-01, then keyword SEVD-14-260-01 to download the vulnerability disclosure. This URL site can also be used to download firmware updates identified in the vulnerability disclosure.

Schneider Electric also recommends the following measures to mitigate the vulnerability for the remaining affected devices:

• Use a deep packet inspection firewall to prevent HTTP requests to the product that contains traversals in the URL.

• Disable Port 80 (HTTP) on modules where it is possible.

• Block Port 80 in firewalls to these devices, except for trusted devices.

Please contact Schneider Electric Customer Care Center for more information.

ADP Enrichment

CVE Program Container

Additional References

• http://www.securityfocus.com/bid/70193
• https://ics-cert.us-cert.gov/advisories/ICSA-14-273-01
• http://download.schneider-electric.com/files?p_Reference=SEVD-2014-260-01&p_EnDocType=Software%20-%20Updates&p_File_Id=608959359&p_File_Name=SEVD-2014-260-01.pdf

References

• http://www.securityfocus.com/bid/70193
• https://www.cisa.gov/news-events/ics-advisories/icsa-14-273-01
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2014-260-01

• ←Previous
• Next→