CVE-2020-7487CWE-345

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218…

published April 22, 2020

CVSS
—
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

⚡ An insufficient verification of data authenticity can let attackers run malicious code on specific Modicon controllers! Imagine the chaos they could unleash! 🔥 Think of these controllers as a restaurant kitchen where a waiter just accepts any order without checking if it's valid — an open invitation for anyone to mess with the menu! If exploited, an attacker could hijack these controllers, potentially disrupting operations or causing damage. This could lead to devastating consequences in industrial settings, where reliability is crucial to safety and productivity.

Put simply

Think of these controllers as a restaurant kitchen where a waiter just accepts any order without checking if it's valid — an open invitation for anyone to mess with the menu! CVE-2020-7487 allows attackers to execute arbitrary code due to the Modicon controllers' failure to properly verify the authenticity of incoming data, making it a serious risk in automation scenarios.

What to do

If exploited, an attacker could hijack these controllers, potentially disrupting operations or causing damage. This could lead to devastating consequences in industrial settings, where reliability is crucial to safety and productivity. To bolster your defenses, update to the latest firmware for Modicon M218, M241, M251, or M258 controllers as soon as possible. Ensure you've implemented robust data verification processes in your automation systems. You've got this! Take action to secure your controllers and keep operations running smoothly! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00692 · 52.3th percentile
Weakness
CWE-345 · Insufficient Verification of Data Authenticity
Published
2020-04-22T18:50Z
EPSS history
Timeline
  • 22 APR 18:50Z
    A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218…
    cvelistv5