CVE-2017-6026: A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and…

PriorityP271critical9.1CVSS 3.1

AVNACLPRNUINSUCHIHAN

EXPLOIT

EPSS

31.82%

98.1th percentile

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	modicon_m241_firmware	<= 4.0.3.20	—
schneider-electric	modicon_m251_firmware	<= 4.0.3.20	—

Detection & IOCsextracted from sources · hover to see the quote

urlhttp://<target_ip>/usr/Syslog/FwLog.txt↗

urlhttp://<target_ip>/plcExchange/getValues/↗

urlhttp://<target_ip>/index2.htm↗

cookieM258_LOG=<username>:<epoch_timestamp>↗

path/usr/Syslog/FwLog.txt↗

path/plcExchange/getValues/↗

path/index2.htm↗

commandS;100;0;136;s;s;S;2;0;24;w;d;S;1;0;8;B;d;S;1;0;9;B;d;S;1;0;10;B;d;S;1;0;11;B;d;↗

→The session cookie 'M258_LOG' is set to a static value derived from the PLC's epoch boot time. Detect authentication attempts using this cookie where the value matches the pattern '<username>:<epoch_integer>' (e.g., 'Administrator:1521612584' or 'USER:1521612584'). The cookie value does not change between reboots. ↗
→Monitor HTTP GET requests to /usr/Syslog/FwLog.txt on Modicon M241/M251 PLCs. This unauthenticated endpoint leaks boot timestamps used to calculate the predictable session cookie. ↗
→Monitor HTTP POST requests to /plcExchange/getValues/ with a Cookie header containing 'M258_LOG=' followed by a username and numeric epoch value. This is the exploitation step after session cookie calculation. ↗
→The session numbers are shared between several users and are not randomized. Any session observed with a predictable integer (epoch-based) value in the M258_LOG cookie should be treated as suspicious, especially if the same session value appears for multiple users. ↗
→Look for HTTP requests to /index2.htm on Modicon PLCs accompanied by a crafted M258_LOG cookie — this is the final exploitation step to gain authenticated web access. ↗
→Default credentials used in exploitation: username 'Administrator' with default password 'admin', or username 'USER' with default password 'USER'. Monitor for login attempts using these credentials. ↗

·The vulnerability only affects Modicon M241 and M251 firmware versions prior to 4.0.5.11. Devices running firmware 4.0.5.11 or later are not affected by CVE-2017-6026. ↗
·Exploitation requires that at least one user has logged in since the last PLC reboot, as the session cookie is only set after a login event. A fresh reboot with no logins will not expose an active session. ↗
·The exploit was tested specifically on the Schneider TM241 PLC with Firmware 4.0.2.11 & Boot 0.0.2.11. Behavior on other minor firmware versions in the affected range may vary. ↗
·The insufficiently protected credentials vulnerability (CVE-2017-6028, Base64-encoded login credentials) has no firmware fix as of the advisory date; only compensating controls were provided by Schneider Electric. ↗

CVSS provenance

nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

nvdv2.06.4MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.