PT-2018-1926 · Schneider Electric · Modicon M221

Published 2018-09-27 · Updated 2026-05-29 · CVE-2018-7798

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:P

Name of the Vulnerable Software and Affected Versions Modicon M221, all versions

Description The issue is related to insufficient verification of data authenticity, which could allow a remote attacker to modify the IPv4 configuration, including IP address, mask, and gateway, when connected to the device. The vulnerability is also associated with the incorrect implementation of the network module in the UMAS protocol, potentially enabling an attacker to intercept the controller's network traffic by remotely modifying configuration parameters.

Recommendations For Modicon M221, all versions: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

BDU:2018-01533

CVE-2018-7798

Affected Products

Modicon M221

References · 7

• https://schneider-electric.com/en/download/document/SEVD-2018-270-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-7798 · Security Note
• https://bdu.fstec.ru/vul/2018-01533 · Security Note
• http://securityfocus.com/bid/105970 · Note
• https://t.me/cveNotify/165210 · Telegram Post
• https://ics-cert.us-cert.gov/advisories/ICSA-18-324-02 · Note
• https://securitylab.ru/news/496619.php · Note