The firmware running on the Schneider Modicon TM221CE16R (Firmware 1.3.3.3) has a hardcoded password, and there is no way to change it.
I believe it is very disconcerting to find systems inside critical infrastructure affected by easy-to-exploit vulnerabilities while we are discussing the EU NIS directive.
What about hard-coded passwords inside critical systems?
Unfortunately, it’s happened again, the firmware running on the Schneider Modicon TM221CE16R (Firmware 1.3.3.3) has a hardcoded password. The bad news for users is that they a cannot change the password and there is no firmware update available to fix this issue.
The firmware encrypted the XML file containing user and password with the fixed key “SoMachineBasicSoMachineBasicSoMa”.
It is quite easy for an attacker to open the control environment (SoMachine Basic 1.4 SP1), decrypt the file, and take control over the device.
“The password for the project protection of the Schneider Modicon TM221CE16R is hard-coded and cannot be changed.” reads the security advisory published by Simon Heming, Maik Brüggemann, Hendrik Schwartke, Ralf Spenneberg of Germany’s Open Source Security.”The protection of the application is not existent.”
The same team of researchers discovered another security issue affecting the Schneider TM221CE16R Firmware 1.3.3.3 hardware. The experts discovered that the password used to protect the applications can be easily retrieved by a remote unauthenticated user. The Application Protection is used to prevent the transfer of the application from a logic controller into a SoMachine Basic project.
“The password for the application protection of the Schneider Modicon TM221CE16R can be retrieved without authentication. Subsequently the application may be arbitrarily downloaded, uploaded and modified. CVSS 10.” reads a separate security advisory published by the team.
The experts discovered that a user just needs to send the following command over Modbus using TCP Port 502:
echo -n -e '\x00\x01\x00\x00\x00\x05\x01\x5a\x00\x03\x00' | nc IP 502
“After that the retrieved password can be entered in SoMachine Basic to download, modify and subsequently upload again any desired application”, continues the advisory.
[adrotate banner=”9″]
(Security Affairs – Schneider Modicon TM221CE16R, hardcoded password)
