PT-2017-17809 · Schneider Electric · Modicon Tm221Ce16R+1

Published 2017-04-06 · Updated 2026-05-29 · CVE-2017-7574

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Schneider Electric SoMachine Basic version 1.4 SP1 Schneider Electric Modicon TM221CE16R version 1.3.3.3

Description The issue concerns a hardcoded-key vulnerability in the Project Protection feature, which is used to prevent unauthorized access to XML protected project files by prompting for a password. The XML file is encrypted using AES-CBC, but the encryption key, SoMachineBasicSoMachineBasicSoMa, is hardcoded and cannot be changed. An attacker can decrypt the XML file using this key, obtain the user password from the decrypted data, and then open and modify the project using the affected product.

Recommendations For Schneider Electric SoMachine Basic version 1.4 SP1, consider disabling the Project Protection feature until a patch is available. For Schneider Electric Modicon TM221CE16R version 1.3.3.3, restrict access to the project files to minimize the risk of exploitation. As a temporary workaround, avoid using the Project Protection feature with the hardcoded key until the issue is resolved.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2017-7574

Affected Products

Modicon Tm221Ce16R

Somachine Basic

References · 7

• https://osv.dev/vulnerability/CVE-2017-7574 · Vendor Advisory
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7574 · Security Note
• https://t.me/cvenotify/19915 · Telegram Post
• https://os-s.net/advisories/OSS-2017-02.pdf · Note
• http://securityfocus.com/bid/97518 · Note
• https://t.me/cveNotify/165190 · Telegram Post