CVE-2017-6026

critical · 9.1

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

9.1

CVSS

31.8%

EPSS (exploit prob.)

98th

EPSS percentile

2017-06-30

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-330

Affected products

Vendor	Product	Affected versions
schneider-electric	modicon_m251_firmware	<= 4.0.3.20
schneider-electric	modicon_m251	all versions
schneider-electric	modicon_m241_firmware	<= 4.0.3.20
schneider-electric	modicon_m241	all versions

Check a specific version with /api/v1/cve/match.

References

http://www.securityfocus.com/bid/97254
https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02
https://www.exploit-db.com/exploits/45918/
http://www.securityfocus.com/bid/97254
https://ics-cert.us-cert.gov/advisories/ICSA-17-089-02
https://www.exploit-db.com/exploits/45918/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2017-6026