{"schemaVersion":3,"id":"CVE-2018-7789","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to remotely reboot Modicon M221 using crafted programing protocol frames.","dates":{"published":"2018-08-29T20:00:00.000Z","modified":"2026-05-29T13:50:59.507Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.8,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":7.8,"severity":"high","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.02797,"percentile":0.86265,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.02797},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02797,"percentile":0.86265}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.02797,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.02797,"percentile":0.86265}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-754","name":"Improper Check for Unusual or Exceptional Conditions","description":"The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/754.html"}],"affected":[{"vendor":"schneider electric se","product":"modicon m221, all references, all versions prior to firmware v1.6.2.0","name":"Modicon M221, all references, all versions prior to firmware V1.6.2.0","label":"modicon m221, all references, all versions prior to firmware v1.6.2.0","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"Modicon M221, all references, all versions prior to firmware V1.6.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"Modicon M221, all references, all versions prior to firmware V1.6.2.0","eol":null,"hubHref":"/vendor/schneider_electric_se/modicon_m221_all_references_all_versions_prior_to_firmware_v1620"},{"vendor":"schneider-electric","product":"modicon_m221_firmware","name":"modicon m221 firmware","label":"modicon_m221_firmware","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 1.6.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.2.0","eol":null,"hubHref":"/vendor/schneider-electric/modicon_m221"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-18-240-02","label":"ics-cert.us-cert.gov/advisories/ICSA-18-240-02","hostname":"ics-cert.us-cert.gov","tags":["X Refsource MISC","Mitigation","Third Party Advisory","US Government Resource"]},{"url":"https://www.schneider-electric.com/en/download/document/SEVD-2018-233-01/","label":"www.schneider-electric.com/en/download/document/SEVD-2018-233-01/","hostname":"www.schneider-electric.com","tags":["X Refsource CONFIRM","Mitigation","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/105171","label":"www.securityfocus.com/bid/105171","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2018-08-29T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-05-29T13:50:59.507Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":32,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T18:39:07.236Z","stale":false,"partial":false}}