CVE-2014-0754 in Modicon PLC Ethernet module
Summary
by MITRE
Directory traversal vulnerability in SchneiderWEB on Schneider Electric Modicon PLC Ethernet modules 140CPU65x Exec before 5.5, 140NOC78x Exec before 1.62, 140NOE77x Exec before 6.2, BMXNOC0401 before 2.05, BMXNOE0100 before 2.9, BMXNOE0110x Exec before 6.0, TSXETC101 Exec before 2.04, TSXETY4103x Exec before 5.7, TSXETY5103x Exec before 5.9, TSXP57x ETYPort Exec before 5.7, and TSXP57x Ethernet Copro Exec before 5.5 allows remote attackers to visit arbitrary resources via a crafted HTTP request.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2025
The CVE-2014-0754 vulnerability represents a critical directory traversal flaw affecting Schneider Electric's Modicon PLC Ethernet modules and related industrial control systems. This vulnerability resides within the SchneiderWEB web interface component of various Schneider Electric products including CPU modules, network modules, and Ethernet coprocessors. The flaw enables remote attackers to access arbitrary files and directories on the affected devices through specially crafted HTTP requests, potentially exposing sensitive system information and compromising industrial control environments. The vulnerability impacts multiple product lines including 140CPU65x series, 140NOC78x series, 140NOE77x series, BMXNOC0401, BMXNOE0100, BMXNOE0110x, TSXETC101, TSXETY4103x, TSXETY5103x, TSXP57x ETYPort, and TSXP57x Ethernet Copro modules.
The technical implementation of this directory traversal vulnerability stems from inadequate input validation within the HTTP request processing mechanism of the SchneiderWEB interface. Attackers can exploit this weakness by crafting HTTP requests containing directory traversal sequences such as "../" or "..\" characters that manipulate the web server's file access routines. When the system processes these malformed requests, it fails to properly sanitize the input paths, allowing unauthorized access to files outside the intended web root directory. This flaw operates at the application layer and leverages the HTTP protocol to execute the traversal attack, making it particularly dangerous in industrial environments where network accessibility may be limited but still present. The vulnerability aligns with CWE-22, which specifically addresses improper limitation of a pathname to a restricted directory, commonly known as path traversal or directory traversal attacks.
The operational impact of this vulnerability extends beyond simple information disclosure, potentially enabling attackers to access critical system files, configuration data, and potentially execute malicious code within the industrial control environment. In industrial settings, this could lead to unauthorized access to programmable logic controller configurations, operational parameters, and system logs that contain sensitive operational data. The remote nature of the attack means that adversaries can exploit this vulnerability from outside the local network perimeter, making it particularly dangerous for industrial control systems that may have limited network segmentation. This vulnerability directly impacts the integrity and confidentiality of industrial control systems, potentially enabling attackers to disrupt operations or gain deeper access to critical infrastructure. The attack vector through HTTP requests makes it particularly challenging to detect and prevent, as it can be executed through standard web browsing tools.
Mitigation strategies for CVE-2014-0754 should focus on immediate firmware updates and network segmentation measures. Schneider Electric released patches for all affected versions, with specific version requirements including 140CPU65x Exec 5.5 and later, 140NOC78x Exec 1.62 and later, 140NOE77x Exec 6.2 and later, and corresponding versions for the other affected modules. Network administrators should implement strict access controls and firewall rules to limit access to these web interfaces, particularly in production environments where unauthorized access could have severe operational consequences. The vulnerability demonstrates the importance of secure coding practices in industrial control systems and aligns with ATT&CK technique T1059.001 for command and scripting interpreter, as attackers could potentially escalate privileges through file access. Organizations should also consider implementing network monitoring to detect unusual HTTP traffic patterns that might indicate exploitation attempts, and maintain comprehensive network segmentation to limit the potential impact of successful attacks. The vulnerability underscores the critical need for regular security assessments and patch management in industrial control systems, particularly given the long lifecycle of many industrial devices that may not receive timely security updates.