CVE-2017-6026: Critical severity schneider-electric modicon m251 vulnerability
A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6026?
CVE-2017-6026 is classified as a medium severity vulnerability due to its potential for session hijacking.
How do I fix CVE-2017-6026?
To mitigate CVE-2017-6026, upgrade the firmware of Schneider Electric Modicon M241 and M251 PLCs to version 4.0.5.11 or later.
Which devices are affected by CVE-2017-6026?
CVE-2017-6026 affects Schneider Electric Modicon M241 and M251 PLCs operating on firmware versions prior to 4.0.5.11.
What type of vulnerability is CVE-2017-6026?
CVE-2017-6026 is categorized as a use of insufficiently random values vulnerability affecting session management.
When was CVE-2017-6026 published?
CVE-2017-6026 was published in March 2017.