CVE-2020-28214

Published: Dec 11, 2020Modified: Jun 17, 2026

5.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.8 / Impact: 3.6

Source: NVD

Description

A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide.

Affected (1)

Products: Schneider Electric: Modicon M221 Firmware

Schneider Electric

1 product

Modicon M221 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M221 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M221	All versions

Related CWEs

Use of a One-Way Hash with a Predictable Salt

The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.

References (4)

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04

Source: cybersecurity@se.com

Third Party AdvisoryUS Government Resource

https://www.se.com/ww/en/download/document/SEVD-2020-315-05/

Source: cybersecurity@se.com

Vendor Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.se.com/ww/en/download/document/SEVD-2020-315-05/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.