How severe is CVE-2017-6030?

CVE-2017-6030 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.

Is CVE-2017-6030 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2017-6030?

CVE-2017-6030 primarily affects Schneider-electric Modicon M241 Firmware. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2017-6030?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2017-6030 published?

CVE-2017-6030 was published on 2017-06-30 and last updated on 2026-06-17.

CVE-2017-6030

CVE-2017-6030 is a medium-severity vulnerability in Schneider-electric Modicon M241 Firmware with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-331.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 6.4
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-331
Affected product: Schneider-electric Modicon M241 Firmware
Published: 2017-06-30
Last modified: 2026-06-17

Description

A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected products generate insufficiently random TCP initial sequence numbers that may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections.

Frequently asked questions

What is CVE-2017-6030?: A predictable value range from previous values issue was discovered in Schneider Electric Modicon PLCs Modicon M221, firmware versions prior to Version 1.5.0.0, Modicon M241, firmware versions prior to Version 4.0.5.11, and Modicon M251, firmware versions prior to Version 4.0.5.11. The affected products generate insufficiently random TCP initial sequence numbers that may allow an attacker to predict the numbers from previous values. This may allow an attacker to spoof or disrupt TCP connections.
How severe is CVE-2017-6030?: CVE-2017-6030 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity low, and availability low.
Is CVE-2017-6030 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2017-6030?: CVE-2017-6030 primarily affects Schneider-electric Modicon M241 Firmware. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2017-6030?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2017-6030 published?: CVE-2017-6030 was published on 2017-06-30 and last updated on 2026-06-17.

References

Affected products (3)

cpe:2.3:o:schneider-electric:modicon_m241_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_m251_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:schneider-electric:modicon_m221_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Schneider-electric Modicon M241 Firmware

CVE-2020-7487 — Critical (CVSS 9.8): A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to…
CVE-2017-6028 — Critical (CVSS 9.8): An Insufficiently Protected Credentials issue was discovered in Schneider Electric Modicon PLCs Modicon M241, all…
CVE-2017-6026 — Critical (CVSS 9.1): A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware…
CVE-2019-6820 — High (CVSS 8.2): A CWE-306: Missing Authentication for Critical Function vulnerability exists which could cause a modification of device…
CVE-2021-22699 — High (CVSS 7.5): Improper Input Validation vulnerability exists in Modicon M241/M251 logic controllers firmware prior to V5.1.9.1 that…
CVE-2020-7488 — High (CVSS 7.5): A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information…

All CVEs affecting Schneider-electric Modicon M241 Firmware →

Other CWE-331 vulnerabilities

CVE-2020-36925 — Critical (CVSS 9.8): Arteco Web Client DVR/NVR contains a session hijacking vulnerability with insufficient session ID complexity that…
CVE-2025-47781 — Critical (CVSS 9.8): Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application…
CVE-2024-47945 — Critical (CVSS 9.8): The devices are vulnerable to session hijacking due to insufficient entropy in its session ID generation algorithm.…
CVE-2024-25730 — Critical (CVSS 9.8): Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a…
CVE-2023-49599 — Critical (CVSS 9.8): An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit…
CVE-2022-34294 — Critical (CVSS 9.8): totd 1.5.3 uses a fixed UDP source port in upstream queries sent to DNS resolvers. This allows DNS cache poisoning…

Browse all CWE-331 vulnerabilities →