CVE-2020-7568
low-risk
Published 2020-11-19
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
Do I need to act?
-
0.06% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
4
CVSS 4.3/10
Medium
ADJACENT_NETWORK
/ LOW complexity
Affected Products (1)
Modicon M221 Firmware
Affected Vendors
References (4)
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-05/
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-05/
20
/ 100
low-risk
Severity
15/34 · Moderate
Exploitability
0/34 · Minimal
Exposure
5/34 · Minimal