CVE-2017-6026

Опубликовано: 30 июн. 2017

Источник: nvd

CVSS3: 9.1

CVSS2: 6.4

EPSS Средний

Описание

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

Ссылки

http://www.securityfocus.com/bid/97254
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45918/
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/97254
Third Party Advisory
VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02
Third Party Advisory
US Government Resource
https://www.exploit-db.com/exploits/45918/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:*

Версия до 4.0.3.20 (включая)

cpe:2.3:h:schneider-electric:modicon_m251:-:*:*:*:*:*:*:*

Конфигурация 2

Одновременно

cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:*

Версия до 4.0.3.20 (включая)

cpe:2.3:h:schneider-electric:modicon_m241:-:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.14763

Средний

9.1 Critical

CVSS3

6.4 Medium

CVSS2

Дефекты

CWE-330

Связанные уязвимости

GHSA-c4x2-m5w5-m3rx