VAR-201704-1595
Vulnerability from variot - Updated: 2022-05-17 01:43The Modicon M221CE16R is an integrated programmable controller from Schneider Electric. The Schneider Modicon M221CE16R has a hard-coded vulnerability. The XML file is AES-CBC encrypted, but the key used for encryption is hard-coded and cannot be changed. After decrypting the XML file using the standard password, the attacker can find the user's password in the decrypted data and open and modify the project using SoMachine Basic
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201704-1595",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "electric modicon tm221ce16r",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider",
"version": "1.3.3.3"
},
{
"model": "electric somachine basic sp1",
"scope": "eq",
"trust": 0.6,
"vendor": "schneider",
"version": "1.4"
},
{
"model": "electric modicon tm221ce16r",
"scope": "eq",
"trust": 0.2,
"vendor": "schneider",
"version": ")1.3.3.3*"
},
{
"model": "electric somachine basic sp1",
"scope": "eq",
"trust": 0.2,
"vendor": "schneider",
"version": ")1.4*"
}
],
"sources": [
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
},
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2017-04007",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4",
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [],
"severity": [
{
"author": "CNVD",
"id": "CNVD-2017-04007",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
},
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Modicon M221CE16R is an integrated programmable controller from Schneider Electric. The Schneider Modicon M221CE16R has a hard-coded vulnerability. The XML file is AES-CBC encrypted, but the key used for encryption is hard-coded and cannot be changed. After decrypting the XML file using the standard password, the attacker can find the user\u0027s password in the decrypted data and open and modify the project using SoMachine Basic",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-04007"
},
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
}
],
"trust": 0.72
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2017-04007",
"trust": 0.8
},
{
"db": "IVD",
"id": "6C473DAA-A774-479E-8A52-37ED4FE00BC4",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
},
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"id": "VAR-201704-1595",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
},
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
],
"trust": 0.08
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.8
}
],
"sources": [
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
},
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"last_update_date": "2022-05-17T01:43:14.344000Z",
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 0.6,
"url": "http://seclists.org/bugtraq/2017/apr/19"
},
{
"trust": 0.6,
"url": "https://www.os-s.net/advisories/oss-2017-02.pdf"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
},
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-06T00:00:00",
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
},
{
"date": "2017-04-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-04-06T00:00:00",
"db": "CNVD",
"id": "CNVD-2017-04007"
}
]
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Schneider Modicon M221CE16R Hardcoded Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2017-04007"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Encryption issues",
"sources": [
{
"db": "IVD",
"id": "6c473daa-a774-479e-8a52-37ed4fe00bc4"
}
],
"trust": 0.2
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…