CVE-2020-7567

Published: Nov 19, 2020Modified: May 29, 2026

5.7

Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability: 2.1 / Impact: 3.6

Source: NVD

Description

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys.

Affected (1)

Products: Schneider Electric: Modicon M221 Firmware

Schneider Electric

1 product

Modicon M221 Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Schneider Electric Modicon M221 Firmware	All versions

Running on/with	Platform Versions
Schneider Electric Modicon M221	All versions

Related CWEs

Missing Encryption of Sensitive Data

The product does not encrypt sensitive or critical information before storage or transmission.

References (4)

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04

Source: cybersecurity@se.com

Third Party AdvisoryUS Government Resource

https://www.se.com/ww/en/download/document/SEVD-2020-315-05/

Source: cybersecurity@se.com

Vendor Advisory

https://us-cert.cisa.gov/ics/advisories/icsa-20-343-04

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://www.se.com/ww/en/download/document/SEVD-2020-315-05/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.