Skip to content
CVE Tracker
Back

CVE-2014-0754

Schneider Electric

Critical10.0EPSS 9.5%
Published
Updated
Reserved
Assigned by
icscert

Description

Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.

Scores

CVSS scores of CVE-2014-0754, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)2.0Critical10.0AV:N/AC:L/Au:N/C:C/I:C/A:C
NVDNVD · Modified2.0High10.0AV:N/AC:L/Au:N/C:C/I:C/A:C
EPSS (exploitation in 30 days)
9.5% · top 4.5% of all CVEs (3 Nov 2026)

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 10.0.

Weakness

Affected products

  • Schneider Electric · Ethernet modules for M340, Quantum and Premium PLC ranges

    • affected 140CPU65150
    • affected 140CPU65160
    • affected 140CPU65260
    • affected 140NOC77100
    • affected 140NOC78000
    • affected 140NOC78100
    • affected 140NOE77100
    • affected 140NOE77101
    • affected 140NOE77101C
    • affected 140NOE77110
    • affected 140NOE77111
    • affected 140NOE77111C
    • affected 140NWM10000
    • affected 170ENT11001
    • affected 170ENT11002
    • affected 170ENT11002C
    • affected 171CCC96020
    • affected 171CCC96020C
    • affected 171CCC96030
    • affected 171CCC96030C
    • affected 171CCC98020
    • affected 171CCC98030
    • affected BMXNOC0401
    • affected BMXNOC0402
    • affected BMXNOE0100
    • affected BMXNOE0110
    • affected BMXNOE0110H
    • affected BMXNOR0200H
    • affected BMXP342020
    • affected BMXP342020H
    • affected BMXP342030
    • affected BMXP3420302
    • affected BMXP3420302H
    • affected BMXP342030H
    • affected BMXPRMxxxx
    • affected STBNIC2212
    • affected STBNIP2212
    • affected TSXETC0101
    • affected TSXETC100
    • affected TSXETY110WS
    • and 26 more

What to do

Solution: Please see Schneider Electric’s vulnerability disclosure (SEVD-2014-260-01)Schneider Electric Vulnerability Disclosure – Modicon Ethernet Comm Modules - SEVD-2014-260-01 - http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2014-260-01 . for more detailed information on which product part numbers are affected, as well as the complete list of which devices have released firmware updates available. This vulnerability disclosure can be downloaded at the following URL:  http://www.schneider-electric.com/ww/en/download/

Workaround: Search downloads for SEVD-14-260-01, then keyword SEVD-14-260-01 to download the vulnerability disclosure. This URL site can also be used to download firmware updates identified in the vulnerability disclosure. Schneider Electric also recommends the following measures to mitigate the vulnerability for the remaining affected devices: * Use a deep packet inspection firewall to prevent HTTP requests to the product that contains traversals in the URL. * Disable Port 80 (HTTP) on modules where it is possible. * Block Port 80 in firewalls to these devices, except for trusted devices. Please contact Schneider Electric Customer Care Center for more information.

References (5)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2014-0754 badge
[![CVE-2014-0754](https://trackcve.app/badge/CVE-2014-0754.svg)](https://trackcve.app/cve/CVE-2014-0754)

Record last updated .