Hard-coded credentials in Unity Loader and OS Loader Software
Priority MEDIUM 45CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.
Why it matters now
EPSS 0.01392 72nd percentileScored 2026-11-08
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | Unity Loader and OS Loader Software (All versions) | Unity Loader and OS Loader Software (All versions) | — | No fix listed | CNA |
- Unity Loader and OS Loader Software (All versions) Vendor— Affected Unity Loader and OS Loader Software (All versions) Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:schneider-electric:os_loader:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
| cpe:2.3:a:schneider-electric:unity_loader:*:*:*:*:*:*:*:* | all versions | Vulnerable | Schneider Electric |
- cpe:2.3:a:schneider-electric:os_loader:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
- cpe:2.3:a:schneider-electric:unity_loader:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Schneider Electric
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7498
- 2026-10-03 Alias added: GHSA-9gr7-q555-cfh9
References
Sources
- CVE-2020-7498 · CVE Program
- CVE-2020-7498 · NVD
- FIRST EPSS
- GHSA-9gr7-q555-cfh9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences