A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a chan…

Published 8 y ago 2018-11-02 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.2

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.7%

percentile 52%

Public exploits

none known

A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration (IP address, mask and gateway) when remotely connected to the device.

CISA SSVC assessment

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 5 mo ago 2026-05-29

Exploit prediction (EPSS)

0.66% probability of exploitation in the next 30 days, higher than 52% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	8.2	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L`
NVD	3.1	8.2	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L`
CNA	3.1	8.2	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L`
NVD	2.0	6.4	`AV:N/AC:L/Au:N/C:N/I:P/A:P`

Affected products

Schneider Electric SE Modicon M221, All Versions

Classification

Weakness

CWE-345 Insufficient Verification of Data Authenticity

References

securityfocus.com /bid/105970 · vdb-entry, x_refsource_BID, x_transferred
schneider-electric.com /en/download/document/SEVD-2018-270-01/ · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2018-7798
NVD: CVE-2018-7798

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary