by Kastro
Paper/Archive/CVE-2020-28214

CVE-2020-28214

schneider — A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could…

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 54.9.549 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists in Modicon M221 (all references, all versions), that could allow an attacker to pre-compute the hash value using dictionary attack technique such as rainbow tables, effectively disabling the protection that an unpredictable salt would provide.

Affected

ProductAffectedFixed inSource
Modicon M221 (all references, all versions)Modicon M221 (all references, all versions)–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refse.com/ww/en/download/document/SEVD-2020-315-05refus-cert.cisa.gov/ics/advisories/icsa-20-343-04