CVE-2017-6026
Critical
Description
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
SeverityCritical
CVSS9.1
Exploit probability—
ProductSchneider-electric Modicon M251 Firmware
PublishedJun 30, 2017
First seenJun 30, 2017
Weakness typeCWE-330CWE-330
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric modicon_m251_firmware | v ≤ 4.0.3.20 | — |
| schneider-electric modicon_m241_firmware | v ≤ 4.0.3.20 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.