Predictable Salt Vulnerability in Modicon M221 Product by Schneider Electric
CVE-2020-28214

5.5MEDIUM

Key Information:

Vendor
Schneider Electric
Status
Modicon M221 (all References, All Versions)
Vendor
CVE Published:
11 December 2020

Summary

A vulnerability has been identified in the Modicon M221 product by Schneider Electric, stemming from the use of a predictable salt in its one-way hash implementation. This weakness facilitates attackers in pre-computing hash values through dictionary attack methods, such as rainbow tables. As a result, the effectiveness of the hash’s unpredictability is compromised, making the system susceptible to unauthorized access and data breaches.

Affected Version(s)

Modicon M221 (all references, all ) Modicon M221 (all references, all versions)

References

https://www.se.com/ww/en/download/document/SEVD-2020-315-05/
x_refsource_CONFIRM
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.