What’s Vulnerable › Vulnerabilities

CVE-2017-6034: Schneider Electric Modicon Modbus Protocol Authentication Bypass by Capture-replay

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 5.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-06-30 · updated 2026-06-17
• Weakness: CWE-294

Description

An authentication bypass by capture-replay issue was discovered in Schneider Electric Modicon Modbus Protocol. Sensitive information is transmitted in cleartext in the Modicon Modbus protocol, which may allow an attacker to replay the following commands: run, stop, upload, and download.

Affected products

• Schneider Electric Modicon Modbus Protocol: all versions

References

• http://www.securityfocus.com/bid/97562
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2017/icsa-17-101-01.json
• https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01
• https://www.se.com/us/en/download/document/SEVD-2017-065-01/
• http://www.securityfocus.com/bid/97562
• https://ics-cert.us-cert.gov/advisories/ICSA-17-101-01

Get alerted when CVE-2017-6034 or the next vulnerability affects your stack