Login Request a demo
Medium severity · published Dec 11, 2020
CVE-2020-28214
A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash…
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Modicon M221 Firmware · Schneider-electric
All versions, or not specified · source: NVD
Affected product
MM
Modicon M221 Firmware
Schneider-electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-28214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-28214
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04
Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2020-315-05/
More from Modicon M221 Firmware
9.8
CVE-2020-7489
A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists on EcoStruxure Machine Expert – Basic or…
9.8
CVE-2018-7791
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0)
9.8
CVE-2018-7790
An Information Management Error vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0)
8.2
CVE-2019-6820
A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device IP configuration (IP address, network mask and gateway IP…
7.5
CVE-2018-7821
An Environment (CWE-2) vulnerability exists in SoMachine Basic, all versions, and Modicon M221(all references, all versions prior to firmware V1.10.0.0) which could cause cycle…