Skip to content
CVE Tracker
Back

CVE-2018-7791

A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all…

Critical9.8EPSS 1.9%
Published
Updated
Reserved
Assigned by
schneider

Description

A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric's Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to overwrite the original password with their password. If an attacker exploits this vulnerability and overwrite the password, the attacker can upload the original program from the PLC.

Scores

CVSS scores of CVE-2018-7791, by who scored it
Scored byCVSSScoreVector
CISA-ADPADP (enrichment)3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Modified3.1Critical9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (exploitation in 30 days)
1.9% · top 21% of all CVEs (3 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: yes · Technical impact: total

Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.

Weakness

Affected products

  • Schneider Electric SE · Modicon M221, all references, all versions prior to firmware V1.6.2.0

    • affected Modicon M221, all references, all versions prior to firmware V1.6.2.0

References (2)

Sources

The same CVE in the primary databases and aggregators, to check against.

Record last updated .