CVE-2020-7565: Weak Encryption
Published Nov 19, 2020
·Updated
A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
Affected Software
5 affected components
Schneider-electric Modicon M221 Firmware
Schneider-electric Modicon M221
Schneider Electric Modicon M221
All of the following
Schneider-electric Modicon M221 Firmware
Schneider-electric Modicon M221
Event History
Nov 19, 2020
CVE Published
via MITRE·09:10 PM
Data Sourced
via MITRE·09:10 PM
DescriptionWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2020-7565.
2
What is the severity of CVE-2020-7565?
The severity of CVE-2020-7565 is high with a severity value of 7.3.
3
Which software is affected by CVE-2020-7565?
Modicon M221 (all references, all versions) is affected by CVE-2020-7565.
4
How does CVE-2020-7565 exploit the vulnerability?
CVE-2020-7565 allows the attacker to break the encryption key when they have captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
5
How can I fix CVE-2020-7565?
To fix CVE-2020-7565, update to the latest version of Modicon M221 firmware as provided by Schneider-electric.