cnvd - cnvd-2017-05014

cnvd-2017-05014

Vulnerability from cnvd

Title: Schneider Electric SoMachine Basic和Schneider Electric Modicon TM221CE16R安全绕过漏洞

Description:

Schneider Electric SoMachine Basic和Schneider Electric Modicon TM221CE16R都是法国施耐德电气（Schneider Electric）公司的产品。前者是一款用于在控制平台上完成所有元器件的编程、调试界面；后者是一款可编程控制器。

Schneider Electric SoMachine Basic 1.4 SP1版本和Schneider Electric Modicon TM221CE16R 1.3.3.3版本中存在安全漏洞，该漏洞源于程序使用硬编码的密钥。攻击者可借助Schneider的产品利用该漏洞打开和修改受保护项目文件。

Severity: 高

Formal description:

目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： http://www.schneider-electric.com/ww/en/

Reference: https://os-s.net/advisories/OSS-2017-02.pdf

Impacted products

Name
['施耐德（Schneider Electric） Modicon TM221CE16R 1.3.3.3', '施耐德（Schneider Electric） SoMachine Basic 1.4 SP1']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97518"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-7574",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7574"
    }
  },
  "description": "Schneider Electric SoMachine Basic\u548cSchneider Electric Modicon TM221CE16R\u90fd\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u6b3e\u7528\u4e8e\u5728\u63a7\u5236\u5e73\u53f0\u4e0a\u5b8c\u6210\u6240\u6709\u5143\u5668\u4ef6\u7684\u7f16\u7a0b\u3001\u8c03\u8bd5\u754c\u9762\uff1b\u540e\u8005\u662f\u4e00\u6b3e\u53ef\u7f16\u7a0b\u63a7\u5236\u5668\u3002\r\n\r\nSchneider Electric SoMachine Basic 1.4 SP1\u7248\u672c\u548cSchneider Electric Modicon TM221CE16R 1.3.3.3\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u4f7f\u7528\u786c\u7f16\u7801\u7684\u5bc6\u94a5\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9Schneider\u7684\u4ea7\u54c1\u5229\u7528\u8be5\u6f0f\u6d1e\u6253\u5f00\u548c\u4fee\u6539\u53d7\u4fdd\u62a4\u9879\u76ee\u6587\u4ef6\u3002",
  "discovererName": "Simon Heming, Maik Br\u00c3\u00bcggemann, Hendrik Schwartke, Ralf Spenneberg",
  "formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a\r\nhttp://www.schneider-electric.com/ww/en/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-05014",
  "openTime": "2017-04-22",
  "products": {
    "product": [
      "\u65bd\u8010\u5fb7\uff08Schneider Electric\uff09 Modicon TM221CE16R 1.3.3.3",
      "\u65bd\u8010\u5fb7\uff08Schneider Electric\uff09 SoMachine Basic 1.4 SP1"
    ]
  },
  "referenceLink": "https://os-s.net/advisories/OSS-2017-02.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2017-04-18",
  "title": "Schneider Electric SoMachine Basic\u548cSchneider Electric Modicon TM221CE16R\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2017-7574 (GCVE-0-2017-7574)

Vulnerability from cvelistv5

Published

2017-04-06 21:00

Modified

2024-08-05 16:04

Severity ?

CWE

Summary

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.

References

▼	URL	Tags
	http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01	x_refsource_CONFIRM
	https://os-s.net/advisories/OSS-2017-02.pdf	x_refsource_MISC
	http://www.securityfocus.com/bid/97518	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://os-s.net/advisories/OSS-2017-02.pdf"
          },
          {
            "name": "97518",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97518"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-04-06T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-14T04:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://os-s.net/advisories/OSS-2017-02.pdf"
        },
        {
          "name": "97518",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97518"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-7574",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01",
              "refsource": "CONFIRM",
              "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01"
            },
            {
              "name": "https://os-s.net/advisories/OSS-2017-02.pdf",
              "refsource": "MISC",
              "url": "https://os-s.net/advisories/OSS-2017-02.pdf"
            },
            {
              "name": "97518",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97518"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-7574",
    "datePublished": "2017-04-06T21:00:00",
    "dateReserved": "2017-04-06T00:00:00",
    "dateUpdated": "2024-08-05T16:04:11.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted