Published: 30/06/2017 Updated: 02/02/2022

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

A Use of Insufficiently Random Values issue exists in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

Vulnerable Product	Search on Vulmon	Subscribe to Product
schneider-electric modicon_m251_firmware
schneider-electric modicon_m241_firmware

Schneider Electric PLC suffers from a session calculation authentication bypass vulnerability ...

CWE-330 https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02 http://www.securityfocus.com/bid/97254 https://www.exploit-db.com/exploits/45918/https://nvd.nist.gov https://packetstormsecurity.com/files/150551/Schneider-Electric-PLC-Authentication-Bypass.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2017-6026

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect