CVE-2017-7574: Critical severity Schneider-electric Modicon Tm221ce16r Firmware vulnerability
Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7574?
CVE-2017-7574 is rated as a high-severity vulnerability due to the presence of a hardcoded key that compromises project protection.
How do I fix CVE-2017-7574?
To fix CVE-2017-7574, update to the latest version of Schneider Electric SoMachine or Modicon TM221CE16R firmware that addresses this vulnerability.
What devices are affected by CVE-2017-7574?
CVE-2017-7574 affects Schneider Electric SoMachine Basic 1.4 SP1 and Modicon TM221CE16R version 1.3.3.3.
What is the impact of CVE-2017-7574 vulnerability?
The impact of CVE-2017-7574 can lead to unauthorized access to protected XML project files, allowing potential exploitation.
Are there any mitigations for CVE-2017-7574?
There are no specific mitigations for CVE-2017-7574; the recommended action is to upgrade to secure software versions.