Hash Algorithm Vulnerability in Schneider Electric's Modicon Controllers

CVE-2018-7242

Summary

The vulnerability arises from the use of insecure hash algorithms in Schneider Electric's Modicon Premium, Modicon Quantum, Modicon M340, and BMXNOR0200 controllers. Specifically, the algorithm employed for encrypting passwords is susceptible to hash collision attacks, which could allow an attacker to potentially compromise credentials and gain unauthorized access to affected systems. This vulnerability impacts all versions of the communication modules in these controllers, highlighting the critical need for secure encryption methods in industrial control systems.

References