CVE-2020-7498

Summary

CVE	CVE-2020-7498
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2020-06-16 20:15:00 UTC
Updated	2022-01-31 19:43:00 UTC
Description	A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.

Risk And Classification

Problem Types: CWE-798

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Schneider-electric	Os Loader	All	All	All	All
Application	Schneider-electric	Unity Loader	All	All	All	All
Application	Se	Os Loader	All	All	All	All
Application	Se	Os Loader	All	All	All	All
Application	Se	Unity Loader	All	All	All	All
Application	Se	Unity Loader	All	All	All	All

References

Reference	Source	Link	Tags
Security Notification - Unity Loader and OS Loader Software \| Schneider Electric	MISC	www.se.com	Vendor Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

590732 Schneider Electric Unity Loader Multiple Vulnerabilities (SEVD-2020-161-02)