Schneider Electric Modicon PLCs
At a glance
- Source
- NVD
- EPSS
- EPSS 31.82 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- icscert
- NVD status
- Modified
Description
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
Weaknesses (CWE)
- CWE-330 — Use of Insufficiently Random Values
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2017-15094
- GCVE · GCVE-0-2017-6026
Affected configurations (NVD CPE)
cpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:*≤ 4.0.3.20cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:*≤ 4.0.3.20
Affected products
| Product | Versions |
|---|---|
| Schneider Electric Modicon PLCs | affected Schneider Electric Modicon PLCs |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |