CVE-2020-7498 Hardcoded credentials in Unity Loader and OS Loader Software (All versions)
Hardcoded credentials in Unity and OS Loader software allow unauthorized access to Modicon PLC file transfer services.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-7498?
CVE-2020-7498 is a critical vulnerability in Unity Loader and OS Loader Software (All versions), published on 16 Jun 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.
Weakness: CWE-798
Which versions are affected by CVE-2020-7498?
It affects 2 products.
Products include Schneider-Electric Os Loader, Schneider-Electric Unity Loader.
How do I fix CVE-2020-7498?
No fix has been published for CVE-2020-7498 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-7498 being exploited?
There is no known exploitation of CVE-2020-7498 in the wild and no public exploit code.
Sources
Also known as GHSA-9gr7-q555-cfh9.