CVE-2017-6026
First published: Fri Jun 30 2017(Updated: )
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider-electric Modicon M251 Firmware | <=4.0.3.20 | |
| Schneider-electric Modicon M251 | ||
| Schneider-electric Modicon M241 Firmware | <=4.0.3.20 | |
| Schneider-electric Modicon M241 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/weakness
- agent/references
- agent/type
- agent/event
- agent/severity
- agent/author
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/schneider-electric
- canonical/schneider-electric modicon m251 firmware
- version/schneider-electric modicon m251 firmware/4.0.3.20
- canonical/schneider-electric modicon m251
- canonical/schneider-electric modicon m241 firmware
- version/schneider-electric modicon m241 firmware/4.0.3.20
- canonical/schneider-electric modicon m241