PT-2018-1926 · Schneider Electric · Modicon M221

CVE-2018-7798 · Publicado 2018-09-27 · Atualizado 2026-05-29

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:P

Name of the Vulnerable Software and Affected Versions Modicon M221, all versions

Description The issue is related to insufficient verification of data authenticity, which could allow a remote attacker to modify the IPv4 configuration, including IP address, mask, and gateway, when connected to the device. The vulnerability is also associated with the incorrect implementation of the network module in the UMAS protocol, potentially enabling an attacker to intercept the controller's network traffic by remotely modifying configuration parameters.

Recommendations For Modicon M221, all versions: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Enumeração de Fraquezas

CWE-345

Identificadores relacionados

BDU:2018-01533

CVE-2018-7798

Produtos afetados

Modicon M221

Referências · 7

• https://schneider-electric.com/en/download/document/SEVD-2018-270-01 · Aviso do Fabricante
• http://securityfocus.com/bid/105970 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-7798 · Nota de Segurança
• https://t.me/cveNotify/165210 · Publicação no Telegram
• https://ics-cert.us-cert.gov/advisories/ICSA-18-324-02 · Nota
• https://bdu.fstec.ru/vul/2018-01533 · Nota de Segurança
• https://securitylab.ru/news/496619.php · Nota