MEDIUM🇵🇱 Wersja polska

CVE-2017-6030

CVSS 6.5v3.1pub. 2017-06-30upd. 2026-06-04

A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected products generate insufficiently random TCP initial sequence numbers that may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

  • Schneider Electric Modicon M221

    HW
    Schneider-Electric
    all versions

  • Schneider Electric Modicon M221 Firmware

    OS
    Schneider-Electric
    ≤ 1.1.1.5

  • Schneider Electric Modicon M241

    HW
    Schneider-Electric
    all versions

  • Schneider Electric Modicon M241 Firmware

    OS
    Schneider-Electric
    ≤ 4.0.3.20

  • Schneider Electric Modicon M251

    HW
    Schneider-Electric
    all versions

  • Schneider Electric Modicon M251 Firmware

    OS
    Schneider-Electric
    ≤ 4.0.3.20
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2020-7487CRITICAL9.8PL ✓same product

Niewystarczająca weryfikacja autentyczności danych w sterownikach Schneider Electric Modicon

CVE-2020-7489CRITICAL9.8PL ✓same product

Podatność Injection w oprogramowaniu Schneider Electric – podstawianie DLL

CVE-2018-7790CRITICAL9.8PL ✓same product

Replay attack na uwierzytelnianie w Schneider Electric Modicon M221

CVE-2018-7791CRITICAL9.8PL ✓same product

Nieautoryzowane nadpisanie hasła w Schneider Electric Modicon M221

CVE-2017-6026CRITICAL9.1PL ✓same product

Słabe generowanie numerów sesji w Schneider Electric Modicon M241/M251