← Vulnerability feed

Vulnerability record · CVE-2017-7574 · published 6 April 2017

CVE-2017-7574: Schneider-electric modicon tm221ce16r firmware hard-coded credentials vulnerability

Schneider Electric · Modicon Tm221ce16r Firmware

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.

9.8 CVSS 3.1 Critical EPSS 1.3% · top 31.7% CWE-798 · Hard-coded credentialsCWE-321 · CWE-321
9.8CVSS 3.1 base score, v2 7.5
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
6References
17 Jun 2026Last modified by NVD

Description

Schneider Electric SoMachine Basic 1.4 SP1 and Schneider Electric Modicon TM221CE16R 1.3.3.3 devices have a hardcoded-key vulnerability. The Project Protection feature is used to prevent unauthorized users from opening an XML protected project file, by prompting the user for a password. This XML file is AES-CBC encrypted; however, the key used for encryption (SoMachineBasicSoMachineBasicSoMa) cannot be changed. After decrypting the XML file with this key, the user password can be found in the decrypted data. After reading the user password, the project can be opened and modified with the Schneider product.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01 Vendor Advisory
http://www.securityfocus.com/bid/97518 Third Party AdvisoryVDB Entry
https://os-s.net/advisories/OSS-2017-02.pdf Broken Link
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2017-097-01 Vendor Advisory
http://www.securityfocus.com/bid/97518 Third Party AdvisoryVDB Entry
https://os-s.net/advisories/OSS-2017-02.pdf Broken Link

Track CVE-2017-7574 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-7487Schneider-electric ecostruxure machine expert insufficient verification of data authenticity vulnerabilityA CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modico…EPSS 0.69%9.8CVE-2017-7575Schneider-electric modicon tm221ce16r firmware information exposure vulnerabilitySchneider Electric Modicon TM221CE16R 1.3.3.3 devices allow remote attackers to discover the application-protection password via a \x00\x01\x00\x00\x…EPSS 4.0%9.3CVE-2013-0662Schneider-electric concept out-of-bounds write vulnerabilityMultiple stack-based buffer overflows in ModbusDrv.exe in Schneider Electric Modbus Serial Driver 1.10 through 3.2 allow remote attackers to execute …EPSS 22%8.8CVE-2017-7966Schneider-electric somachine uncontrolled search path element vulnerabilityA DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary…EPSS 2.4%7.5CVE-2020-7488Schneider-electric ecostruxure machine expert cleartext transmission vulnerabilityA CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the softwa…EPSS 0.88%7.5CVE-2014-9200Schneider-electric somachine stack-based buffer overflow vulnerabilityStack-based buffer overflow in an unspecified DLL file in a DTM development kit in Schneider Electric Unity Pro, SoMachine, SoMove, SoMove Lite, Modb…EPSS 5.6%6.8CVE-2020-28220Schneider-electric modicon m258 firmware memory buffer overflow vulnerabilityA CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists in Modicon M258 Firmware (All versions prior …EPSS 1.1%10.0CVE-2026-22769Dell RecoverPoint for Virtual Machines hardcoded credential flawDell RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1 contain a hardcoded credential vulnerability (CWE-798). An unauthenticated remot…KEVEPSS 13%analysed

Source: NIST National Vulnerability Database (record CVE-2017-7574), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.