By default, Modicon FTP Server/Client installs with a default password. The qbf77101 account has a password of hexakisoctahedron which is publicly known and documented. This allows attackers to trivially access the program or system and gain privileged access.

Immediately after installation, change all default installed accounts to use a unique and secure password. When possible, change default account names to custom names as well.

• Generic Exploit URL: http://www.metasploit.com/modules/auxiliary/admin/scada/modicon_password_recovery
• Vendor Specific Advisory URL: http://www.schneider-electric.com/download/ww/en/file/25577737-RES207443.pdf/?fileName=RES207443.pdf&reference=Res207443&docType=Technical-paper
• Other Advisory URL: http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-01.pdf
  http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03.pdf
  http://www.us-cert.gov/control_systems/pdf/ICS-ALERT-12-020-03A.pdf
• Vendor URL: www.schneider-electric.com/

• Rubén Santamarta

NVD does not currently have a CVSSv2 score assigned.