CVE-2017-6026: schneider-electric modicon_m241_firmware Use of Insufficiently Random Values
Vulnerability summary
CVE-2017-6026 is a critical (CVSS 9.1) Use of Insufficiently Random Values vulnerability in schneider-electric modicon_m241_firmware. EPSS estimates a 31.82% chance of exploitation in the next 30 days, higher than 98.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 30-06-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
31.82%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 31.82% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSchneider Electric PLC - Session Calculation Authentication Bypass
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Schneider-electric2 products
- modicon_m241_firmware≤ 4.0.3.20
- modicon_m251_firmware≤ 4.0.3.20
1 vendor · 2 products
References
3 links- ics-cert.us-cert.gov/advisories/ICSA-17-089-02X Refsource MISCThird Party AdvisoryUS Government Resource