Schneider Electric Modicon M221 Programmable Logic Controller

🗓️ 08 Dec 2020 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics🔗 www.cisa.gov👁 47 Views

Schneider Electric Modicon M221 PLC vulnerabilities: inadequate encryption, small random value space, missing sensitive data encryption, sensitive information exposure, predictable salt has

Reporter	Title	Published	Views	Family All 61
BDU FSTEC	The vulnerability of the microprogrammed logic controllers from Schneider Electric, such as Modicon M221, M100, and M200, stems from insufficiently secure data encryption. This allows attackers to obtain the encryption key.	31 Aug 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers Modicon M221, M100, and M200 lies in the small number of possible random values. This allows attackers to circumvent existing security restrictions by using brute-force attacks.	31 Aug 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers Modicon M221, M100, and M200 stems from the lack of encryption measures for protected data. This allows attackers to obtain the encryption key.	31 Aug 202100:00	–	bdu_fstec
BDU FSTEC	The vulnerability of microprogrammed software in Schneider Electric’s programmable logic controllers Modicon M221, M100, and M200 relates to the disclosure of information, which allows unauthorized access to protected data by attackers.	2 Sep 202100:00	–	bdu_fstec
Circl	CVE-2020-28214	11 Dec 202007:35	–	circl
Circl	CVE-2020-7565	20 Nov 202000:42	–	circl
Circl	CVE-2020-7567	20 Nov 202000:41	–	circl
Circl	CVE-2020-7568	20 Nov 202000:41	–	circl
CNNVD	Schneider Electric Modicon M221 加密问题漏洞	19 Nov 202000:00	–	cnnvd
CNNVD	Schneider Electric Modicon M221 Security Breach	19 Nov 202000:00	–	cnnvd

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2020/icsa-20-343-04.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-20-343-04
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B
us-cert	www.us-cert.cisa.gov/ncas/tips/ST04-014

08 Dec 2020 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 24.3

CVSS 3.17.3 - 9.8

EPSS0.00093

SSVC