The hook
Modicon M221 controllers are operational technology assets, so a public firmware signal carries a different risk profile than a normal web-app banner. CVE-2018-7789 and CVE-2018-7790 apply to Modicon M221 firmware versions prior to V1.6.2.0 and describe remote reboot plus authentication replay risk for attackers who can connect to the PLC.
How it works
The check stays passive. It requires target-specific HTTP evidence for Modicon M221 plus a firmware-version label below V1.6.2.0, suppresses advisory/documentation pages, and records what was observed. It does not send programming-protocol frames, query Modbus, trigger reboots, capture or replay credentials, authenticate to the controller, upload PLC programs, or prove unauthorized access.
The blast radius
If a real Modicon M221 controller with affected firmware is reachable from untrusted networks, the vendor and NVD advisory context should drive urgent firmware validation, management-interface restriction, and log review. The result is a critical version-based advisory, not proof that FixVibe reproduced reboot or replay behavior.
// what fixvibe checks
What FixVibe checks
FixVibe maps externally visible application surfaces with passive signals and safe metadata checks. Reports summarize the exposed surface and remediation priorities. For check-specific questions about exact detection heuristics, active payload details, or source-code rule patterns, contact support@fixvibe.app.
Ironclad defenses
Upgrade Modicon M221 firmware to V1.6.2.0 or later, verify the running firmware directly from trusted controller inventory or Schneider-supported tooling, block remote/external access to industrial management ports such as TCP/502, disable unused protocols including programming protocol where possible, and restrict management to trusted industrial networks or VPN.