IM
IronMonkey Threat Research
‹ Back to ICS Advisories

Modicon M100/M200/M221 Programmable Logic Controller (V3.0)

HIGH
CVSS 7.1
Date 2026-10-16T20:41:15+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 10-Nov-20 (12-Jan-21) Document Reference Number – SEVD-2020 -315-05 V3.0 Page 1 of 4 ## Modicon M100/M200/M221 Programmable Logic Controller (V3.0) 10 November 2020 (12 January 2021) # Overview Schneider Electric is aware of multiple vulnerabilities in its Modicon M100, M200, and M221 products. The Modicon M100/M200/M221 are Nano Programmable Logic Controllers (PLC) made to control basic automation for machines. The M100/M200/M221 are configured using Machine Expert - Basic software. Failure to apply the mitigations provided below may allow unauthorized users to replay authentication sequences, which could result in an attacker taking control over the PLC. January 2021 update: Added Modicon M100 and M200 to the list of affected products. # Affected Product and Versions Modicon M100/M200/M221, all references, all versions # Vulnerability Details CVE ID: CVE-2020-7565 CVSS v3.0 Base Score 7.1 | High | CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-326: Inadequate Encryption Strength vulnerability exists that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M100/M200/M221 controllers. CVE ID: CVE-2020-7566 CVSS v3.0 Base Score 7.1 | High | CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H A CWE-334: Small Space of Random Values vulnerability exists that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M100/M200/M221 controllers. CVE ID: CVE-2020-7567 CVSS v3.0 Base Score 7.1 | High | CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

// Vulnerabilities (5)

CVE ID CVSS Score Severity Description
CVE-2020-28214 7.1 high
A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide.
CVE-2020-7567 7.1 high
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to find the password hash when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller and broke the encryption keys.
CVE-2020-7565 7.1 high
A CWE-326: Inadequate Encryption Strength vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption key when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
CVE-2020-7566 7.1 high
A CWE-334: Small Space of Random Values vulnerability exists in Modicon M221 (all references, all versions) that could allow the attacker to break the encryption keys when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.
CVE-2020-7568 7.1 high
A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Modicon M221 (all references, all versions) that could allow non sensitive information disclosure when the attacker has captured the traffic between EcoStruxure Machine - Basic software and Modicon M221 controller.

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Software, LLC Schneider Electric Software, LLC Modicon M221 plc
L1
vers:all/*

// Remediations (12)

Mitigation: Install physical controls so no unauthorized personnel can access industrial control and safety syst
Install physical controls so no unauthorized personnel can access industrial control and safety systems, components, peripheral equipment, and networks.
Mitigation: Minimize network exposure for all control system devices and systems and ensure that they are not ac
Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
Mitigation: Refer to Schneider Electric's security bulletin SEVD-2020-315-05 for specific mitigation details.
Refer to Schneider Electric's security bulletin SEVD-2020-315-05 for specific mitigation details.
Mitigation: Never allow mobile devices that have connected to any other network, besides the intended network, t
Never allow mobile devices that have connected to any other network, besides the intended network, to connect to the safety or control networks without proper sanitation.
Mitigation: Scan all methods of mobile data exchange with the isolated network (e.g., CDs, USB drives, etc.) bef
Scan all methods of mobile data exchange with the isolated network (e.g., CDs, USB drives, etc.) before use in the terminals or any node connected to these networks.
Mitigation: When remote access is required, use secure methods such as virtual private networks (VPNs). Recogniz
When remote access is required, use secure methods such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
Mitigation: Locate control and safety system networks and remote devices behind firewalls and isolate them from
Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
Patch: Within the Modicon M221 application, the user must: Disable all unused protocols, especially program
Within the Modicon M221 application, the user must: Disable all unused protocols, especially programming protocol, as described in section “Configuring Ethernet Network” of EcoStruxure Machine Expert - Basic online help for the M221 PLC. This action will prevent unintended remote programming access.;Set a password to protect the project.;Set a password for read access on the controller.;Set a different password for write access on the controller.
Mitigation: For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices docume
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.
Mitigation: Place all controllers in locked cabinets and never leave them in the “Program” mode.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Mitigation: Never connect programming software to any network other than the network for which the devices were
Never connect programming software to any network other than the network for which the devices were intended.
Mitigation: Set up network segmentation and implement a firewall to block all unauthorized access to Port 502/TC
Set up network segmentation and implement a firewall to block all unauthorized access to Port 502/TCP.

// References