What is the severity of CVE-2017-6026?

CVE-2017-6026 is classified as a medium severity vulnerability due to its potential for session hijacking.

How do I fix CVE-2017-6026?

To mitigate CVE-2017-6026, upgrade the firmware of Schneider Electric Modicon M241 and M251 PLCs to version 4.0.5.11 or later.

Which devices are affected by CVE-2017-6026?

CVE-2017-6026 affects Schneider Electric Modicon M241 and M251 PLCs operating on firmware versions prior to 4.0.5.11.

What type of vulnerability is CVE-2017-6026?

CVE-2017-6026 is categorized as a use of insufficiently random values vulnerability affecting session management.

When was CVE-2017-6026 published?

CVE-2017-6026 was published in March 2017.

Vulnerability/
CVE-2017-6026

critical

9.1

CWE

330

30/6/2017

5/8/2024

CVE-2017-6026

First published: Fri Jun 30 2017(Updated: )

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

Credit: ics-cert@hq.dhs.gov

Affected Software	Affected Version	How to fix
schneider-electric Modicon M251	<=4.0.3.20
Modicon M251
Schneider Electric Modicon M241	<=4.0.3.20
Schneider Electric Modicon M241

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the severity of CVE-2017-6026?
CVE-2017-6026 is classified as a medium severity vulnerability due to its potential for session hijacking.
How do I fix CVE-2017-6026?
To mitigate CVE-2017-6026, upgrade the firmware of Schneider Electric Modicon M241 and M251 PLCs to version 4.0.5.11 or later.
Which devices are affected by CVE-2017-6026?
CVE-2017-6026 affects Schneider Electric Modicon M241 and M251 PLCs operating on firmware versions prior to 4.0.5.11.
What type of vulnerability is CVE-2017-6026?
CVE-2017-6026 is categorized as a use of insufficiently random values vulnerability affecting session management.
When was CVE-2017-6026 published?
CVE-2017-6026 was published in March 2017.

agent/type
collector/mitre-cve
source/MITRE
agent/last-modified-date
agent/author
agent/weakness
agent/references
agent/severity
agent/event
agent/description
agent/first-publish-date
agent/source
agent/softwarecombine
agent/tags
collector/nvd-index
agent/software-canonical-lookup-request
vendor/schneider-electric
canonical/schneider-electric modicon m251
version/schneider-electric modicon m251/4.0.3.20
canonical/modicon m251
canonical/schneider electric modicon m241
version/schneider electric modicon m241/4.0.3.20

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.