CVE-2020-7498
Last modified
CVE-2020-7498 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. EPSS estimates a 1.36% chance of exploitation in the next 30 days.
Description
A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Os Loader | All versions |
| Schneider-Electric | Unity Loader | All versions |
References
- https://www.se.com/ww/en/download/document/SEVD-2020-161-02Vendor Advisory
- https://www.se.com/ww/en/download/document/SEVD-2020-161-02Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-7498?
How severe is CVE-2020-7498?
How do I fix CVE-2020-7498?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-7492A CWE-521: Weak Password Requirements vulnerability exists i…6.5
- CVE-2020-7493A CWE-89: Improper Neutralization of Special Elements used i…7.8
- CVE-2020-7494A CWE-22: Improper Limitation of a Pathname to a Restricted …7.8
- CVE-2020-7495A CWE-22: Improper Limitation of a Pathname to a Restricted …5.5
- CVE-2020-7496A CWE-88: Argument Injection or Modification vulnerability e…7.8
- CVE-2020-7497A CWE-22: Improper Limitation of a Pathname to a Restricted …9.8
- CVE-2020-7499A CWE-863: Incorrect Authorization vulnerability exists in U…6.5
- CVE-2020-7500A CWE-89:Improper Neutralization of Special Elements used in…9.8
- CVE-2020-7501A CWE-798: Use of Hard-coded Credentials vulnerability exist…8.8
- CVE-2020-7502A CWE-787: Out-of-bounds Write vulnerability exists in Modic…7.5
- CVE-2020-7503A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability e…8.8
- CVE-2020-7504A CWE-20: Improper Input Validation vulnerability exists in …5.3
Are you affected by CVE-2020-7498?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST