CVE-2017-6026

Critical

Published: 30/06/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241 and M251. The session numbers generated by the web application lack sufficient randomization and are shared among users, potentially allowing for session compromise.

Risk Assessment

The lack of proper randomness in session numbers poses a risk of session hijacking by unauthorized users, which could lead to unauthorized access to the system.

Recommendation

It is recommended to update the firmware to version 4.0.5.11 or later to address the session randomness issue.

Original NVD description (English source)

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.