CVE-2017-7574

CVE-2017-7574 details a hardcoded-key vulnerability in Schneider Electric SoMachine Basic 1.4 SP1 and Modicon TM221CE16R 1.3.3.3 devices. The Project Protection feature, intended to secure XML project files with a password, uses AES-CBC encryption with a static, unchangeable key. This allows an attacker to decrypt the project file, extract the user password, and gain full access to modify the project. Rated CVSS 9.8 Critical, this vulnerability presents a high risk due to its network-based attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. An attacker can remotely exploit this without user interaction or prior authentication. Currently, there is no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available. Community discussion and media coverage for this CVE are minimal, aligning with the typical low attention for most vulnerabilities.