CVE-2018-7790 — Authentication Bypass by Capture-replay in Modicon M221 Firmware

CWE-294 — Authentication Bypass by Capture-replay3 documents3 sources
Severity
9.8CRITICALNVD
EPSS
1.1%
top 21.64%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Schneider-electric Modicon M221 Firmware
Timeline
PublishedAug 29
Latest updateMay 13

Description

An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a Modicon M221, the attacker can upload the original program from the PLC.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 3.9 | Impact: 5.9

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-xvmg-mf7x-g2hx: An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1↗2022-05-13
▶
CVEList
CVE-2018-7790: An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1↗2018-08-29
▶
CVE-2018-7790 — Authentication Bypass by Capture-replay | cvebase