CVE-2018-7792 json
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versio…
published 2018-08-29 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-19504
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.0%
- EPSS 1.0% chance of exploitation in 30 days, percentile 64%
- public exploits
- 0
- none known
Summary
A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to decode the password using rainbow table.
Patch / fix
- schneider-electric modicon_m221_firmware 1.6.2.0
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-18-240-01 updated cvss 7.7
Schneider Electric Modicon M221
-
Schneider Electric Software, LLC Modicon M221 all references < 1.6.2.0affected: mitigation “As a temporary mitigation, Modicon M221 users should take the following measures: Set up a firewall blocking all remote/external access to Port 502.” schneider-electric.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 5 mo ago
Exploit prediction
1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Schneider Electric SE Modicon M221, all references, all versions prior to firmware V1.6.2.0
Classification
References
-
schneider-electric.com
/en/download/document/SEVD-2018-235-01/
mitigation, vendor-advisory
-
securityfocus.com
/bid/105182
vdb-entry, third-party-advisory
Sources
- CVE List CVE-2018-7792
- NVD CVE-2018-7792
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.