PT-2017-17810 · Schneider Electric · Modicon Tm221Ce16R

Published 2017-04-06 · Updated 2026-05-29 · CVE-2017-7575

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schneider Electric Modicon TM221CE16R version 1.3.3.3

Description The issue allows remote attackers to discover the application-protection password by sending a specific request to the Modbus port (502/tcp). After obtaining the password, an attacker can arbitrarily download, modify, and upload the application.

Recommendations For Schneider Electric Modicon TM221CE16R version 1.3.3.3, as a temporary workaround, consider restricting access to the Modbus port (502/tcp) to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-7575

Affected Products

Modicon Tm221Ce16R

References · 6

• 🔥 https://os-s.net/advisories/OSS-2017-01.pdf · Exploit
• https://osv.dev/vulnerability/CVE-2017-7575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-7575 · Security Note
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-02 · Note
• http://securityfocus.com/bid/97523 · Note
• https://t.me/cveNotify/165191 · Telegram Post