A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Vers…

Published 9 y ago 2017-06-30 · modified 4 mo ago 2026-06-17 · JSON

CVSS

9.1

v3.1 · NVD

CISA KEV

not known exploited

EPSS

31.8%

percentile 98%

Public exploits

Exploit-DB

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

Exploit prediction (EPSS)

31.82% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

EDB-45918 Schneider Electric PLC - Session Calculation Authentication Bypass · webapps · 2018-11-30

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	9.1	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`
NVD	2.0	6.4	`AV:N/AC:L/Au:N/C:P/I:P/A:N`

Affected products

n/a Schneider Electric Modicon PLCs

Classification

Weakness

CWE-330 Use of Insufficiently Random Values

References

ics-cert.us-cert.gov /advisories/ICSA-17-089-02 · x_refsource_MISC, x_transferred
securityfocus.com /bid/97254 · vdb-entry, x_refsource_BID, x_transferred
exploit-db.com /exploits/45918/ · exploit, x_refsource_EXPLOIT-DB, x_transferred

Sources

CVE List: CVE-2017-6026
NVD: CVE-2017-6026

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary