PT-2020-6348 · Schneider Electric · Modicon M100+3

Published

2020-11-10

·

Updated

2026-05-29

·

CVE-2020-7565

CVSS v2.0

7.8

High

VectorAV:A/AC:L/Au:N/C:C/I:C/A:N
Name of the Vulnerable Software and Affected Versions Modicon M221 (all versions) Modicon M100 (affected versions not specified) Modicon M200 (affected versions not specified)
Description A CWE-326: Inadequate Encryption Strength issue exists that could allow an attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and the Modicon controller. This could permit a remote attacker to obtain the encryption key.
Recommendations For Modicon M221, consider disabling the encryption functionality until a patch is available. For Modicon M100 and Modicon M200, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

BDU:2021-04281
CVE-2020-7565

Affected Products

Ecostruxure Machine - Basic
Modicon M100
Modicon M200
Modicon M221