CVE-2020-28214: Critical severity Schneider-electric Modicon M221 Firmware vulnerability

Published Dec 11, 2020

Updated

A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide.

Affected Software

5 affected components

Schneider-electric Modicon M221 Firmware

Schneider-electric Modicon M221

Schneider Electric Modicon M221

All of the following

Schneider-electric Modicon M221 Firmware

Schneider-electric Modicon M221

Event History

Dec 11, 2020

CVE Published

via MITRE·12:51 AM

Data Sourced

via MITRE·12:51 AM

DescriptionWeakness

Data Sourced

via NVD·01:15 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

ICSA-20-343-04

Frequently Asked Questions

What is CVE-2020-28214?

CVE-2020-28214 is a vulnerability in Modicon M221 that allows an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables.

How does the CVE-2020-28214 vulnerability impact Modicon M221?

The CVE-2020-28214 vulnerability in Modicon M221 could allow an attacker to disable the protection of the device by predicting the hash value using rainbow tables.

What is the severity of CVE-2020-28214?

CVE-2020-28214 has a severity score of 5.5, which is considered medium.

How can I fix the CVE-2020-28214 vulnerability in Modicon M221?

To fix the CVE-2020-28214 vulnerability in Modicon M221, it is recommended to update to the latest firmware version provided by Schneider-electric.

Where can I find more information about CVE-2020-28214?

You can find more information about CVE-2020-28214 on the official Schneider-electric website and the US-CERT advisory.