Vulnerability-Lookup

CNVD-2017-04918

Vulnerability from cnvd - Published: 2017-04-10

Title

Schneider Electric Modicon PLC多重身份验证绕过漏洞（CNVD-2017-04918）

Description

Modicon PLC是用于水坝、能源、食品农业等等行业的可编程控制器产品。 Schneider Electric Modicon PLC存在多重身份验证绕过漏洞，访问OT网络的攻击者可以拦截到目标PLC的流量，包括向设备发送管理命令所需的会话标识符。

Severity

中

Patch Name

Schneider Electric Modicon PLC多重身份验证绕过漏洞（CNVD-2017-04918）的补丁

Patch Description

Modicon PLC是用于水坝、能源、食品农业等等行业的可编程控制器产品。 Schneider Electric Modicon PLC存在多重身份验证绕过漏洞，访问OT网络的攻击者可以拦截到目标PLC的流量，包括向设备发送管理命令所需的会话标识符。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页: http://www.securityweek.com/plcs-several-vendors-vulnerable-replay-attacks

Reference

http://securityaffairs.co/wordpress/57731/malware/clearenergy-ransomware-scada.html http://www.securityfocus.com/bid/97562

Impacted products

Name
Schneider Electric Modicon PLC

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97562"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-6034"
    }
  },
  "description": "Modicon PLC\u662f\u7528\u4e8e\u6c34\u575d\u3001\u80fd\u6e90\u3001\u98df\u54c1\u519c\u4e1a\u7b49\u7b49\u884c\u4e1a\u7684\u53ef\u7f16\u7a0b\u63a7\u5236\u5668\u4ea7\u54c1\u3002 \r\n\r\nSchneider Electric Modicon PLC\u5b58\u5728\u591a\u91cd\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8bbf\u95eeOT\u7f51\u7edc\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u62e6\u622a\u5230\u76ee\u6807PLC\u7684\u6d41\u91cf\uff0c\u5305\u62ec\u5411\u8bbe\u5907\u53d1\u9001\u7ba1\u7406\u547d\u4ee4\u6240\u9700\u7684\u4f1a\u8bdd\u6807\u8bc6\u7b26\u3002",
  "discovererName": "Eran Goldstein of CRITIFENCE",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875: \r\nhttp://www.securityweek.com/plcs-several-vendors-vulnerable-replay-attacks",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-04918",
  "openTime": "2017-04-10",
  "patchDescription": "Modicon PLC\u662f\u7528\u4e8e\u6c34\u575d\u3001\u80fd\u6e90\u3001\u98df\u54c1\u519c\u4e1a\u7b49\u7b49\u884c\u4e1a\u7684\u53ef\u7f16\u7a0b\u63a7\u5236\u5668\u4ea7\u54c1\u3002 \r\n\r\nSchneider Electric Modicon PLC\u5b58\u5728\u591a\u91cd\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff0c\u8bbf\u95eeOT\u7f51\u7edc\u7684\u653b\u51fb\u8005\u53ef\u4ee5\u62e6\u622a\u5230\u76ee\u6807PLC\u7684\u6d41\u91cf\uff0c\u5305\u62ec\u5411\u8bbe\u5907\u53d1\u9001\u7ba1\u7406\u547d\u4ee4\u6240\u9700\u7684\u4f1a\u8bdd\u6807\u8bc6\u7b26\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Schneider Electric Modicon PLC\u591a\u91cd\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2017-04918\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Schneider Electric Modicon PLC"
  },
  "referenceLink": "http://securityaffairs.co/wordpress/57731/malware/clearenergy-ransomware-scada.html\r\nhttp://www.securityfocus.com/bid/97562",
  "serverity": "\u4e2d",
  "submitTime": "2017-04-10",
  "title": "Schneider Electric Modicon PLC\u591a\u91cd\u8eab\u4efd\u9a8c\u8bc1\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2017-04918\uff09"
}

CVE-2017-6034 (GCVE-0-2017-6034)

Vulnerability from cvelistv5 – Published: 2017-06-30 02:35 – Updated: 2026-06-04 21:07

Title

Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay

Summary

An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 19:09 UTC

CWE

CWE-294

Assigner

icscert icscert root Scorecard

References

4 references

URL	Tags
https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01
http://www.securityfocus.com/bid/97562	vdb-entryx_refsource_BID
https://github.com/cisagov/CSAF/blob/develop/csaf…
https://www.se.com/us/en/download/document/SEVD-2…

Impacted products

1 product

Vendor	Product	Version
Schneider Electric	Modicon Modbus Protocol	Affected: all versions

Date Public

2017-06-29 00:00

Credits

Eran Goldstein of CRITIFENCE reported the identified vulnerabilities.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T15:18:49.398Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01"
          },
          {
            "name": "97562",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97562"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.8,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2017-6034",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T19:09:00.802921Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T19:09:05.551Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Modicon Modbus Protocol",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "all versions"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Eran Goldstein of CRITIFENCE reported the identified vulnerabilities."
        }
      ],
      "datePublic": "2017-06-29T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.\u003c/p\u003e"
            }
          ],
          "value": "An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-294",
              "description": "CWE-294",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T21:07:21.157Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01"
        },
        {
          "name": "97562",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97562"
        },
        {
          "url": "https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2017/icsa-17-101-01.json"
        },
        {
          "url": "https://www.se.com/us/en/download/document/SEVD-2017-065-01/"
        }
      ],
      "source": {
        "advisory": "ICSA-17-101-01",
        "discovery": "UNKNOWN"
      },
      "title": "Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSchneider Electric has reported that they have introduced compensating controls to limit the exploitability of the identified vulnerabilities in many of the PLCs in the Modicon family; however, Schneider Electric recommends that users apply security measures to improve resiliency.\u003c/p\u003e\u003cp\u003eSchneider Electric\u2019s Momentum M1E controllers (all versions of model 171CBU98090 and all versions of model 171CBU98091) do not have built-in compensating controls to limit the exploitability of the identified vulnerabilities and Schneider Electric instructs users to take the following defensive measures:\u003c/p\u003e\u003cul\u003e\u003cli\u003eProtect access to M1E controllers by a firewall blocking all remote/external access to Port 502.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eSchneider Electric reports that Modicon M340, M580, Premium and Quantum users should take one or more of the following defensive measures:\u003c/p\u003e\u003cul\u003e\u003cli\u003eEnable protection based on an authentication to connect to PLC. This method relies on a feature named Application Password. Once enabled, password-based authentication is required whenever a user connects to change their application program;\u003c/li\u003e\u003cli\u003eEnable protection relying on an input (M340, Premium, Quantum) or a key switch in the front panel (Quantum) to reject remote connection or run/stop commands; and\u003c/li\u003e\u003cli\u003eEnable the \u201cAccess Control List protection,\u201d where users are able to configure the restricted IP addresses that are pre-authorized to control the PLC.\u003c/li\u003e\u003c/ul\u003e\u003cp\u003eFor additional information, Schneider Electric has released a Cybersecurity Notification, which is available at the following location:\u003c/p\u003e\u003cp\u003ehttps://www.se.com/us/en/download/document/SEVD-2017-065-01/\u0026nbsp;\u003c/p\u003e"
            }
          ],
          "value": "Schneider Electric has reported that they have introduced compensating controls to limit the exploitability of the identified vulnerabilities in many of the PLCs in the Modicon family; however, Schneider Electric recommends that users apply security measures to improve resiliency.\n\n\n\nSchneider Electric\u2019s Momentum M1E controllers (all versions of model 171CBU98090 and all versions of model 171CBU98091) do not have built-in compensating controls to limit the exploitability of the identified vulnerabilities and Schneider Electric instructs users to take the following defensive measures:\n\n  *  Protect access to M1E controllers by a firewall blocking all remote/external access to Port 502.\n\n\n\n\nSchneider Electric reports that Modicon M340, M580, Premium and Quantum users should take one or more of the following defensive measures:\n\n  *  Enable protection based on an authentication to connect to PLC. This method relies on a feature named Application Password. Once enabled, password-based authentication is required whenever a user connects to change their application program;\n  *  Enable protection relying on an input (M340, Premium, Quantum) or a key switch in the front panel (Quantum) to reject remote connection or run/stop commands; and\n  *  Enable the \u201cAccess Control List protection,\u201d where users are able to configure the restricted IP addresses that are pre-authorized to control the PLC.\n\n\n\n\nFor additional information, Schneider Electric has released a Cybersecurity Notification, which is available at the following location:\n\n\n\nhttps://www.se.com/us/en/download/document/SEVD-2017-065-01/"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2017-6034",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Schneider Electric Modicon Modbus Protocol",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Schneider Electric Modicon Modbus Protocol"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An Authentication Bypass by Capture-Replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-294"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01",
              "refsource": "MISC",
              "url": "https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01"
            },
            {
              "name": "97562",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97562"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2017-6034",
    "datePublished": "2017-06-30T02:35:00.000Z",
    "dateReserved": "2017-02-16T00:00:00.000Z",
    "dateUpdated": "2026-06-04T21:07:21.157Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-04918

CVE-2017-6034 (GCVE-0-2017-6034)

Tags

Sightings

Nomenclature

Related by attack behaviour