CVE-2017-7574

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.

CVSS v3 9.8 CRITICAL
CVSS v2.0 7.5 HIGH

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01	Vendor Advisory
http://www.securityfocus.com/bid/97518	Third Party Advisory VDB Entry
https://os-s.net/advisories/OSS-2017-02.pdf	Broken Link

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:schneider-electric:modicon_tm221ce16r_firmware:1.3.3.3:*:*:*:*:*:*:*

cpe:2.3:h:schneider-electric:modicon_tm221ce16r:-:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:schneider-electric:somachine:1.4:sp1:*:*:*:*:*:*

History

No history.

Information

Published : 2017-04-06 21:59

Updated : 2022-02-10 07:22

NVD link : CVE-2017-7574

Mitre link : CVE-2017-7574

CVE.ORG link : CVE-2017-7574

JSON object : View

Products Affected

schneider-electric

modicon_tm221ce16r_firmware
modicon_tm221ce16r
somachine

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2017-7574", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-04-06T21:59:00.307", "references": [{"url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/97518", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "https://os-s.net/advisories/OSS-2017-02.pdf", "tags": ["Broken Link"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product."}, {"lang": "es", "value": "Los dispositivos Schneider Electric SoMachine Basic 1.4 SP1 y Schneider Electric Modicon TM221CE16R 1.3.3.3 tienen una vulnerabilidad de clave codificada. La funci\u00f3n Protecci\u00f3n de proyectos se utiliza para evitar que usuarios no autorizados abran un archivo de proyecto protegido XML, solicitando al usuario una contrase\u00f1a. Este archivo XML es AES-CBC cifrado; Sin embargo, no se puede cambiar la clave utilizada para el cifrado (SoMachineBasicSoMachineBasicSoMa). Despu\u00e9s de descifrar el archivo XML con esta clave, la contrase\u00f1a de usuario se puede encontrar en los datos descifrados. Despu\u00e9s de leer la contrase\u00f1a de usuario, el proyecto se puede abrir y modificar con el producto Schneider."}], "lastModified": "2022-02-10T07:22:32.767", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:schneider-electric:modicon_tm221ce16r_firmware:1.3.3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26C40BAF-2C91-4069-A62E-1B1E60BA1619"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:schneider-electric:modicon_tm221ce16r:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "00715571-AC4B-4B1F-8E65-385B56F2004C"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:schneider-electric:somachine:1.4:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "85698ADE-078B-4461-BA24-C88BB16C6E50"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}