CVE-2017-6028

published 2017-06-30

CVE-2017-6028: An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all…

critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials could then be used to log into the web application.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	modicon_m241_firmware	<= 4.0.3.20	—
schneider-electric	modicon_m251_firmware	<= 4.0.3.20	—

CWE-522