CVE-2020-7566 describes a CWE-334 vulnerability in Schneider Electric Modicon M221 controllers and firmware, where a small space of random values used for encryption keys can be exploited. An attacker on the same network segment (adjacent) can capture traffic between EcoStruxure Machine - Basic software and the controller, then break the encryption keys due to this weakness. This vulnerability carries a CVSS v3.1 score of 7.3 (High), indicating high impact on confidentiality and integrity, but requires user interaction for exploitation. While no active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion has been observed, the EPSS score is very low, suggesting a low probability of exploitation in the wild.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
Range not provided by sourceCPE matchmatch criteria | cpe:2.3:o:schneider-electric:modicon_m221_firmware:-:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.