CVE-2017-6028: Critical severity schneider electric modicon m241 vulnerability
An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all firmware versions, and Modicon M251, all firmware versions. Log-in credentials are sent over the network with Base64 encoding leaving them susceptible to sniffing. Sniffed credentials could then be used to log into the web application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6028?
CVE-2017-6028 is classified as a high severity vulnerability due to its risk of credential exposure.
How do I fix CVE-2017-6028?
To fix CVE-2017-6028, implement secure communication methods such as encryption to protect login credentials.
What devices are affected by CVE-2017-6028?
CVE-2017-6028 affects Schneider Electric Modicon M241 and Modicon M251 PLCs across all firmware versions.
What types of credentials are at risk in CVE-2017-6028?
CVE-2017-6028 risks the exposure of login credentials that are transmitted using Base64 encoding.
Is it possible to mitigate CVE-2017-6028 without a firmware update?
Yes, you can mitigate CVE-2017-6028 by employing network security measures such as VPNs or firewalls.