CVE-2017-7574

 

Published at: - 06-04-2017 11:59

Last modified: - 10-02-2022 08:22

Total changes: - 4

Description

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Verification logic

 

Reference

• https://os-s.net/advisories/OSS-2017-02.pdf
• 97518-Third Party Advisory, VDB Entry
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01

 

Keywords

NVD

 

CVE-2017-7574

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures