Schneider Electric Modicon m221 Firmware vulnerabilities

16 CVEs affecting Schneider Electric Modicon m221 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-28214, published 2020-12-11.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10953, published 2019-04-17. High severity, CVSS 7.5. EPSS: 3.4% chance of exploitation in the next 30 days. ABB, Phoenix Contact, Schneider Electric, Siemens, WAGO - Programmable Logic Controllers, multiple versions. Researchers have found some controllers are susceptible to a denial-of-service attack due…
CVE-2018-7789, published 2018-08-29. High severity, CVSS 7.5. EPSS: 2.8% chance of exploitation in the next 30 days. An Improper Check for Unusual or Exceptional Conditions vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability…
CVE-2018-7790, published 2018-08-29. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized…
CVE-2017-6030, published 2017-06-30. Medium severity, CVSS 6.5. EPSS: 2.1% chance of exploitation in the next 30 days. A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior…
CVE-2018-7791, published 2018-08-29. Critical severity, CVSS 9.8. EPSS: 1.9% chance of exploitation in the next 30 days. A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows…
CVE-2020-7489, published 2020-04-22. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or SoMachine Basic programming…
CVE-2018-7823, published 2019-05-22. Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days. A Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause remote launch of SoMachine…
CVE-2019-6820, published 2019-05-22. High severity, CVSS 8.2. EPSS: 1.3% chance of exploitation in the next 30 days. A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP address) when a…
CVE-2018-7821, published 2019-05-22. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle time impact when…
CVE-2018-7792, published 2018-08-29. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows…

Latest

CVE-2020-28214, published 2020-12-11. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using…
CVE-2020-7568, published 2020-11-19. Medium severity, CVSS 4.3. EPSS: 0.5% chance of exploitation in the next 30 days. A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when…
CVE-2020-7567, published 2020-11-19. Medium severity, CVSS 5.7. EPSS: 0.2% chance of exploitation in the next 30 days. A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has…
CVE-2020-7566, published 2020-11-19. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured…
CVE-2020-7565, published 2020-11-19. High severity, CVSS 7.3. EPSS: 0.3% chance of exploitation in the next 30 days. A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured…
CVE-2018-7822, published 2019-05-22. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. An Incorrect Default Permissions (CWE-276) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause…