Log in Start free

Vulnerability · Published Jun 16, 2020 · Assigned by schneider

CVE-2020-7498

Critical 9.8

In plain English

A critical-severity hard-coded credentials in Unity Loader and OS Loader Software (All versions). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)1.4%top 27.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Unity Loader and OS Loader Software (all versions). The fixed credentials are used to simplify file transfer. Today the use of fixed credentials is considered a vulnerability, which could cause unauthorized access to the file transfer service provided by the Modicon PLCs. This could result in various unintended results.

Affected products (as reported)

VendorProductVersions
n/a Unity Loader and OS Loader Software (All versions) Unity Loader and OS Loader Software (All versions)

Weakness: CWE-798

References