PT-2017-3707 · Schneider Electric · Modicon M340+3
Alexey Stennikov
+7
·
Publicado
2017-04-28
·
Atualizado
2024-04-10
·
CVE-2018-7242
CVSS v2.0
10
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions:
Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers (affected versions not specified)
Description:
The issue concerns a vulnerable hash algorithm used for password encryption in the communication modules of the mentioned controllers. This vulnerability makes the algorithm susceptible to hash collision attacks. Additionally, errors in the implementation of the cryptographic algorithm in the FTP server of the programmable logic controllers' firmware may allow a remote attacker to guess passwords.
Recommendations:
For all affected versions, consider disabling or restricting access to the vulnerable communication modules until a secure alternative or patch is available.
As a temporary workaround, restrict access to the FTP server to minimize the risk of exploitation.
Avoid using weak passwords and consider implementing additional security measures to protect against remote attacks.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Use of a Broken Cryptographic Algorithm
Inadequate Encryption Strength
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Bmxnor0200
Modicon M340
Modicon Premium
Modicon Quantum