Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.

Project Subscriptions

Vendors Products
Schneider-electric Subscribe
171ccc96020 Subscribe
171ccc96020 Firmware Subscribe
171ccc96020c Subscribe
171ccc96020c Firmware Subscribe
171ccc96030 Subscribe
171ccc96030 Firmware Subscribe
171ccc96030c Subscribe
171ccc96030c Firmware Subscribe
171ccc98020 Subscribe
171ccc98020 Firmware Subscribe
171ccc98030 Subscribe
171ccc98030 Firmware Subscribe
Modicon M340 Bmxnoc0401 Subscribe
Modicon M340 Bmxnoc0401 Firmware Subscribe
Modicon M340 Bmxnoe0100 Subscribe
Modicon M340 Bmxnoe0100 Firmware Subscribe
Modicon M340 Bmxnoe0110 Subscribe
Modicon M340 Bmxnoe0110 Firmware Subscribe
Modicon M340 Bmxnoe0110h Subscribe
Modicon M340 Bmxnoe0110h Firmware Subscribe
Modicon M340 Bmxnor0200h Subscribe
Modicon M340 Bmxnor0200h Firmware Subscribe
Modicon M340 Bmxp342020 Subscribe
Modicon M340 Bmxp342020 Firmware Subscribe
Modicon M340 Bmxp342020h Subscribe
Modicon M340 Bmxp342020h Firmware Subscribe
Modicon M340 Bmxp342030 Subscribe
Modicon M340 Bmxp3420302 Subscribe
Modicon M340 Bmxp3420302 Firmware Subscribe
Modicon M340 Bmxp3420302h Subscribe
Modicon M340 Bmxp3420302h Firmware Subscribe
Modicon M340 Bmxp342030 Firmware Subscribe
Modicon M340 Bmxp342030h Subscribe
Modicon M340 Bmxp342030h Firmware Subscribe
Modicon M580 Bmxnoc0402 Subscribe
Modicon M580 Bmxnoc0402 Firmware Subscribe
Stbnic2212 Subscribe
Stbnic2212 Firmware Subscribe
Stbnip2212 Subscribe
Stbnip2212 Firmware Subscribe
Tsxetc0101 Subscribe
Tsxetc0101 Firmware Subscribe
Tsxetc100 Subscribe
Tsxetc100 Firmware Subscribe
Tsxety110ws Subscribe
Tsxety110ws Firmware Subscribe
Tsxety110wsc Subscribe
Tsxety110wsc Firmware Subscribe
Tsxety4103 Subscribe
Tsxety4103 Firmware Subscribe
Tsxety4103c Subscribe
Tsxety4103c Firmware Subscribe
Tsxety5103 Subscribe
Tsxety5103 Firmware Subscribe
Tsxety5103c Subscribe
Tsxety5103c Firmware Subscribe
Tsxetz410 Subscribe
Tsxetz410 Firmware Subscribe
Tsxetz510 Subscribe
Tsxetz510 Firmware Subscribe
Tsxntp100 Subscribe
Tsxntp100 Firmware Subscribe
Tsxp571634m Subscribe
Tsxp571634m Firmware Subscribe
Tsxp572634m Subscribe
Tsxp572634m Firmware Subscribe
Tsxp573623mc Subscribe
Tsxp573623mc Firmware Subscribe
Tsxp573634m Subscribe
Tsxp573634m Firmware Subscribe
Tsxp574634m Subscribe
Tsxp574634m Firmware Subscribe
Tsxp574823am Subscribe
Tsxp574823am Firmware Subscribe
Tsxp574823m Subscribe
Tsxp574823m Firmware Subscribe
Tsxp574823mc Subscribe
Tsxp574823mc Firmware Subscribe
Tsxp575634m Subscribe
Tsxp575634m Firmware Subscribe
Tsxp576634m Subscribe
Tsxp576634m Firmware Subscribe
Tsxwmy100 Subscribe
Tsxwmy100 Firmware Subscribe
Tsxwmy100c Subscribe
Tsxwmy100c Firmware Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2014-0785 Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.
Fixes

Solution

Please see Schneider Electric’s vulnerability disclosure (SEVD-2014-260-01)Schneider Electric Vulnerability Disclosure – Modicon Ethernet Comm Modules - SEVD-2014-260-01 - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2014-260-01 . for more detailed information on which product part numbers are affected, as well as the complete list of which devices have released firmware updates available. This vulnerability disclosure can be downloaded at the following URL:  http://www.schneider-electric.com/ww/en/download/


Workaround

Search downloads for SEVD-14-260-01, then keyword SEVD-14-260-01 to download the vulnerability disclosure. This URL site can also be used to download firmware updates identified in the vulnerability disclosure. Schneider Electric also recommends the following measures to mitigate the vulnerability for the remaining affected devices: * Use a deep packet inspection firewall to prevent HTTP requests to the product that contains traversals in the URL. * Disable Port 80 (HTTP) on modules where it is possible. * Block Port 80 in firewalls to these devices, except for trusted devices. Please contact Schneider Electric Customer Care Center for more information.

History

Tue, 26 Aug 2025 00:00:00 +0000


Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: icscert

Published:

Updated: 2025-08-25T23:45:03.684Z

Reserved: 2014-01-02T00:00:00

Link: CVE-2014-0754

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2014-10-03T18:55:06.017

Modified: 2025-08-26T00:15:30.757

Link: CVE-2014-0754

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses