Improper check for unusual conditions in Modicon Quantum Ethernet Network module and…
Priority MEDIUM 42CWE-754Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Quantum Ethernet Network module 140NOE771x1 (Versions 7.0 and prior), Quantum processors with integrated Ethernet – 140CPU65xxxxx (all Versions), and Premium processors with integrated Ethernet (all Versions), which could cause a Denial of Service when sending a specially crafted command over Modbus.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01321 71st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions) | Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions) | — | No fix listed | CNA |
- Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions) Vendor— Affected Modicon Quantum Ethernet Network module and Quantum / Premium COPRO (Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior, Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions, Premium processors with integrated Ethernet, all versions) Fixed in — No fix listed CNA
CPE configurations NVD · 56
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:140noe77101_firmware:*:*:*:*:*:*:*:* | up to 7.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140noe77101:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140noe77111_firmware:*:*:*:*:*:*:*:* | up to 7.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140noe77111:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxh5744m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxh5744m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxh5724m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxh5724m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp576634m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp576634m_:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:140noe77101_firmware:*:*:*:*:*:*:*:* Versions up to 7.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140noe77101:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140noe77111_firmware:*:*:*:*:*:*:*:* Versions up to 7.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140noe77111:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxh5744m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxh5744m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxh5724m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxh5724m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp576634m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp576634m_:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Show 46 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:tsxp57554m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp57554m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp575634m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp575634m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp57454m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp57454m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp574634m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp574634m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp573634m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp573634m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp57304m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp57304m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp57254m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp57254m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp572634m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp572634m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp57204m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp57204m_:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp571634m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp571634m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp57154m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp57154m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:tsxp57104m_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:tsxp57104m:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu65150_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu65150:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu65160_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu65160:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu65260_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu65260:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu67261_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu67261:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu67060_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu67060:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu67160_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu67160:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu67260_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu67260:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu65860_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu65860:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu67861_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu67861:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu65160s_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu65160s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:140cpu67160s_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:140cpu67160s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:tsxp57554m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp57554m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp575634m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp575634m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp57454m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp57454m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp574634m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp574634m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp573634m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp573634m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp57304m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp57304m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp57254m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp57254m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp572634m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp572634m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp57204m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp57204m_:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp571634m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp571634m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp57154m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp57154m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:tsxp57104m_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:tsxp57104m:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu65150_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu65150:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu65160_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu65160:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu65260_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu65260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu67261_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu67261:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu67060_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu67060:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu67160_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu67160:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu67260_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu67260:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu65860_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu65860:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu67861_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu67861:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu65160s_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu65160s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:140cpu67160s_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:140cpu67160s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7477
- 2026-10-03 Alias added: GHSA-pf3g-p3qp-7mc8
References
More Schneider Electric 140cpu65150 Firmware vulnerabilities
- TI-2018-05250 Hard-coded credentials in Schneider Electric Modicon Premium, Modicon Quantum, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2020-06063 Missing authentication in Web Server on Modicon M340, Legacy Offers Modicon Quantum and… CVSS 3.1CRITICAL 9.8
- TI-2018-05604 Improper input validation in Schneider Electric Modicon M340, Modicon Premium, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2018-05251 Vulnerable hash algorithms exists in Schneider Electric's Modicon Premium, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2018-05603 Improper authentication in Schneider Electric Modicon M340, Modicon Premium, Modicon… CVSS 3.0CRITICAL 9.8
- TI-2018-05249 Out-of-bounds write in Schneider Electric Modicon Quantum CVSS 3.0HIGH 8.8
Sources
- CVE-2020-7477 · CVE Program
- CVE-2020-7477 · NVD
- FIRST EPSS
- GHSA-pf3g-p3qp-7mc8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences