Vulnetix
Try Vulnetix Request Demo
CVE-2017-6026 PUBLISHED CVSS 9.100000381469727 CRITICAL

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

EPSS 18.57% · 95.2th percentile

Risk Scores

CVSS v3.1
9.100000381469727
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score
18.57%
95.2th percentile

Affected Products

VendorProductVersions
schneider-electricmodicon_m251_firmware0
n/aSchneider Electric Modicon PLCsSchneider Electric Modicon PLCs
schneider-electricmodicon_m241_firmware0

Timeline

References

Open in Interactive Console →