CVE-2018-7790
published 2018-08-29CVE-2018-7790: An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0)…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
2.48%
82.7th percentile
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a Modicon M221, the attacker can upload the original program from the PLC.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| schneider-electric | modicon_m221_firmware | < 1.6.2.0 | 1.6.2.0 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xvmg-mf7x-g2hx: An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1
ghsa_unreviewed·2022-05-13
CVE-2018-7790 [CRITICAL] CWE-294 GHSA-xvmg-mf7x-g2hx: An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to replay authentication sequences. If an attacker exploits this vulnerability and connects to a Modicon M221, the attacker can upload the original program from the PLC.
CISA ICS
Schneider Electric Modicon M221
cisa_ics·2018-08-28·CVSS 9.8
[CRITICAL] Schneider Electric Modicon M221
## Archived Content In an effort to keep CISA.gov current, the archive contains outdated information that may not reflect current policy or programs.
ICS Advisory
##
Schneider Electric Modicon M221
Last RevisedAugust 28, 2018
Alert CodeICSA-18-240-01
## 1. EXECUTIVE SUMMARY
-
CVSS v3 7.7
- ATTENTION: Exploitable remotely
- Vendor: Schneider Electric
- Equipment: Modicon M221
- Vulnerabilities: Information Management Errors, Permissions, Privileges, and Access Controls
## 2. RISK EVALUATION
Successful exploitation of these vulnerabilities may allow unauthorized users to replay authentication sequences, overwrite passwords, or decode passwords.
## 3. TECHNICAL DETAILS
## 3.1 AFFECTED PRODUCTS
Schneider Electric reports the vulnerabili
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-08-29
Published