Most recent entries from all

bdu:2021-04281

certfr-2020-avi-726 — De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permetten…

certfr-2020-avi-726

cnvd-2024-38820

EUVD-2026-322709

fkie_cve-2020-7565

A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.

GHSA-93f9-wg2h-r6p5

gsd-2020-7565

ICSA-20-343-04 — Schneider Electric Modicon M221 Programmable Logic Controller

An inadequate encryption strength vulnerability exists that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.CVE-2020-7565 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). A small space of random values vulnerability exists that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.CVE-2020-7566 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). A missing encryption of sensitive data vulnerability exists that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and has broken the encryption keys.CVE-2020-7567 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). An exposure of sensitive information to an unauthorized actor vulnerability exists that could allow non-sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.CVE-2020-7568 ha…

SEVD-2020-315-05 — Modicon M100/M200/M221 Programmable Logic Controller

Schneider Electric is aware of multiple vulnerabilities in its Modicon M100, M200, and M221 products. The Modicon M100/M200/M221 are Nano Programmable Logic Controllers (PLC) made to control basic automation for machines. The M100/M200/M221 are configured using Machine Expert - Basic software. Failure to apply the mitigations provided below may allow unauthorized users to replay authentication sequences, which could result in an attacker taking control over the PLC. January 2021 update: Added Modicon M100 and M200 to the list of affected products.