PT-2019-1483 · Schneider Electric · Somachine Basic+1

Published 2019-02-14 · Updated 2022-01-31 · CVE-2018-7822

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions SoMachine Basic versions prior to V1.10.0.0 Modicon M221 versions prior to V1.10.0.0

Description The issue is related to incorrect default permissions, which could allow an attacker to gain access to SoMachine Basic resource files when logged on the system hosting SoMachine Basic. This is due to improper default settings of access rights.

Recommendations For SoMachine Basic versions prior to V1.10.0.0, update to firmware V1.10.0.0 or later to resolve the issue. For Modicon M221 versions prior to V1.10.0.0, update to firmware V1.10.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the system hosting SoMachine Basic to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

BDU:2019-00891

CVE-2018-7822

Affected Products

Modicon M221

Somachine Basic

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2018-7822 · Security Note
• https://schneider-electric.com/en/download/document/SEVD-2019-045-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00891 · Security Note
• https://osv.dev/vulnerability/CVE-2018-7822 · Vendor Advisory
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-045-01-SoMachineBasic+M221.pdf&p_Doc_Ref=SEVD-2019-045-01 · Note
• https://t.me/cvenotify/19909 · Telegram Post
• https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2019-045-01-SoMachineBasic+M221.pdf&p_Doc_Ref=SEVD-2019-045-01 · Note