How severe is CVE-2017-6026?

CVE-2017-6026 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2017-6026 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 32% (98th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-6026?

CVE-2017-6026 primarily affects Schneider-electric Modicon M251 Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-6026?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2017-6026 published?

CVE-2017-6026 was published on 2017-06-30 and last updated on 2026-06-17.

CVE-2017-6026

CVE-2017-6026 is a critical-severity vulnerability in Schneider-electric Modicon M251 Firmware with a CVSS 3.x base score of 9.1. Its EPSS exploit-prediction score of 32% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-330.

Key facts

Severity: Critical (CVSS 3.x base score 9.1)
CVSS v2: 6.4
EPSS exploit prediction: 32% (98th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-330
Affected product: Schneider-electric Modicon M251 Firmware
Published: 2017-06-30
Last modified: 2026-06-17

Description

A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.

Frequently asked questions

What is CVE-2017-6026?: A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The session numbers generated by the web application are lacking randomization and are shared between several users. This may allow a current session to be compromised.
How severe is CVE-2017-6026?: CVE-2017-6026 has a CVSS 3.x base score of 9.1, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.
Is CVE-2017-6026 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 32% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-6026?: CVE-2017-6026 primarily affects Schneider-electric Modicon M251 Firmware. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-6026?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2017-6026 published?: CVE-2017-6026 was published on 2017-06-30 and last updated on 2026-06-17.

References

Affected products (2)

cpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Schneider-electric Modicon M251 Firmware

CVE-2020-7487 — Critical (CVSS 9.8): A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to…
CVE-2017-6028 — Critical (CVSS 9.8): An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all…
CVE-2019-6820 — High (CVSS 8.2): A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device…
CVE-2021-22699 — High (CVSS 7.5): Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that…
CVE-2020-7488 — High (CVSS 7.5): A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information…
CVE-2017-6030 — Medium (CVSS 6.5): A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221,…

All CVEs affecting Schneider-electric Modicon M251 Firmware →

Other CWE-330 (Use of Insufficiently Random Values) vulnerabilities

CVE-2023-22601 — Critical (CVSS 10.0): InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version…
CVE-2026-25072 — Critical (CVSS 9.8): XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier…
CVE-2026-27755 — Critical (CVSS 9.8): SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability…
CVE-2026-27637 — Critical (CVSS 9.8): FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206,…
CVE-2025-64097 — Critical (CVSS 9.8): NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A…
CVE-2025-4607 — Critical (CVSS 9.8): The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up…

Browse all CWE-330 (Use of Insufficiently Random Values) vulnerabilities →