PT-2017-16845 · Schneider Electric · Modicon M221+2

David Formby + 1 · Published 2017-06-30 · Updated 2026-06-04 · CVE-2017-6030

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon M221 versions prior to 1.5.0.0 Schneider Electric Modicon M241 versions prior to 4.0.5.11 Schneider Electric Modicon M251 versions prior to 4.0.5.11

Description A Predictable Value Range from Previous Values issue was discovered in Schneider Electric Modicon PLCs. The affected products generate insufficiently random TCP initial sequence numbers, which may allow an attacker to predict the numbers from previous values. This could enable an attacker to spoof or disrupt TCP connections.

Recommendations For Schneider Electric Modicon M221 versions prior to 1.5.0.0, update to version 1.5.0.0 or later. For Schneider Electric Modicon M241 versions prior to 4.0.5.11, update to version 4.0.5.11 or later. For Schneider Electric Modicon M251 versions prior to 4.0.5.11, update to version 4.0.5.11 or later.

Fix

Weakness Enumeration

CWE-343

CWE-331

Related Identifiers

CVE-2017-6030

Affected Products

Modicon M221

Modicon M241

Modicon M251

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-6030 · Security Note
• https://osv.dev/vulnerability/CVE-2017-6030 · Vendor Advisory
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2017/icsa-17-089-02.json · Note
• https://t.me/cveNotify/166089 · Telegram Post
• https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02 · Note
• https://t.me/cveNotify/165192 · Telegram Post
• http://securityfocus.com/bid/97254 · Note