Vulnerability-Lookup

CNVD-2017-05014

Vulnerability from cnvd - Published: 2017-04-22

Title

Schneider Electric SoMachine Basic和Schneider Electric Modicon TM221CE16R安全绕过漏洞

Description

Schneider Electric SoMachine Basic和Schneider Electric Modicon TM221CE16R都是法国施耐德电气（Schneider Electric）公司的产品。前者是一款用于在控制平台上完成所有元器件的编程、调试界面；后者是一款可编程控制器。 Schneider Electric SoMachine Basic 1.4 SP1版本和Schneider Electric Modicon TM221CE16R 1.3.3.3版本中存在安全漏洞，该漏洞源于程序使用硬编码的密钥。攻击者可借助Schneider的产品利用该漏洞打开和修改受保护项目文件。

Severity

高

Formal description

目前厂商暂未发布修复措施解决此安全问题，建议使用此软件的用户随时关注厂商主页或参考网址以获取解决办法： http://www.schneider-electric.com/ww/en/

Reference

https://os-s.net/advisories/OSS-2017-02.pdf

Impacted products

Name
['施耐德（Schneider Electric） Modicon TM221CE16R 1.3.3.3', '施耐德（Schneider Electric） SoMachine Basic 1.4 SP1']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "97518"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-7574",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7574"
    }
  },
  "description": "Schneider Electric SoMachine Basic\u548cSchneider Electric Modicon TM221CE16R\u90fd\u662f\u6cd5\u56fd\u65bd\u8010\u5fb7\u7535\u6c14\uff08Schneider Electric\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002\u524d\u8005\u662f\u4e00\u6b3e\u7528\u4e8e\u5728\u63a7\u5236\u5e73\u53f0\u4e0a\u5b8c\u6210\u6240\u6709\u5143\u5668\u4ef6\u7684\u7f16\u7a0b\u3001\u8c03\u8bd5\u754c\u9762\uff1b\u540e\u8005\u662f\u4e00\u6b3e\u53ef\u7f16\u7a0b\u63a7\u5236\u5668\u3002\r\n\r\nSchneider Electric SoMachine Basic 1.4 SP1\u7248\u672c\u548cSchneider Electric Modicon TM221CE16R 1.3.3.3\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u4f7f\u7528\u786c\u7f16\u7801\u7684\u5bc6\u94a5\u3002\u653b\u51fb\u8005\u53ef\u501f\u52a9Schneider\u7684\u4ea7\u54c1\u5229\u7528\u8be5\u6f0f\u6d1e\u6253\u5f00\u548c\u4fee\u6539\u53d7\u4fdd\u62a4\u9879\u76ee\u6587\u4ef6\u3002",
  "discovererName": "Simon Heming, Maik Br\u00c3\u00bcggemann, Hendrik Schwartke, Ralf Spenneberg",
  "formalWay": "\u76ee\u524d\u5382\u5546\u6682\u672a\u53d1\u5e03\u4fee\u590d\u63aa\u65bd\u89e3\u51b3\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u5efa\u8bae\u4f7f\u7528\u6b64\u8f6f\u4ef6\u7684\u7528\u6237\u968f\u65f6\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u6216\u53c2\u8003\u7f51\u5740\u4ee5\u83b7\u53d6\u89e3\u51b3\u529e\u6cd5\uff1a\r\nhttp://www.schneider-electric.com/ww/en/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-05014",
  "openTime": "2017-04-22",
  "products": {
    "product": [
      "\u65bd\u8010\u5fb7\uff08Schneider Electric\uff09 Modicon TM221CE16R 1.3.3.3",
      "\u65bd\u8010\u5fb7\uff08Schneider Electric\uff09 SoMachine Basic 1.4 SP1"
    ]
  },
  "referenceLink": "https://os-s.net/advisories/OSS-2017-02.pdf",
  "serverity": "\u9ad8",
  "submitTime": "2017-04-18",
  "title": "Schneider Electric SoMachine Basic\u548cSchneider Electric Modicon TM221CE16R\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

CVE-2017-7574 (GCVE-0-2017-7574)

Vulnerability from cvelistv5 – Published: 2017-04-06 21:00 – Updated: 2026-05-29 13:32

Summary

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.

Severity

10 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-29 13:27 UTC

CWE

n/a
CWE-321 - Use of Hard-coded Cryptographic Key

Assigner

mitre mitre root Scorecard

References

3 references

URL	Tags
http://download.schneider-electric.com/files?p_Do…	x_refsource_CONFIRM
https://os-s.net/advisories/OSS-2017-02.pdf	x_refsource_MISC
http://www.securityfocus.com/bid/97518	vdb-entryx_refsource_BID

Date Public

2017-04-06 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T16:04:11.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://os-s.net/advisories/OSS-2017-02.pdf"
          },
          {
            "name": "97518",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/97518"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 10,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "NONE",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2017-7574",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-29T13:27:52.090116Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-321",
                "description": "CWE-321 Use of Hard-coded Cryptographic Key",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-29T13:32:04.296Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2017-04-06T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-04-14T04:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://os-s.net/advisories/OSS-2017-02.pdf"
        },
        {
          "name": "97518",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/97518"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2017-7574",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01",
              "refsource": "CONFIRM",
              "url": "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01"
            },
            {
              "name": "https://os-s.net/advisories/OSS-2017-02.pdf",
              "refsource": "MISC",
              "url": "https://os-s.net/advisories/OSS-2017-02.pdf"
            },
            {
              "name": "97518",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/97518"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2017-7574",
    "datePublished": "2017-04-06T21:00:00.000Z",
    "dateReserved": "2017-04-06T00:00:00.000Z",
    "dateUpdated": "2026-05-29T13:32:04.296Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CNVD-2017-05014

CVE-2017-7574 (GCVE-0-2017-7574)

Tags

Sightings

Nomenclature

Related by attack behaviour