SchneiderWEB Server Directory Traversal Vulnerability

An attacker with network access to the web HMI could read sensitive configuration files, engineering data, or system information from the device, potentially revealing process logic, credentials, or network topology information. This could enable further attacks on the control system.

This vulnerability affects Schneider Electric industrial automation devices across energy and manufacturing sectors, including: Modicon M340 PLCs (140CPU, 140NOC, 140NOE, 140NWM series), Modicon Quantum processors (BMXP, BMXNOC, BMXNOE, BMXNOR series), TSX Micro controllers (TSXP, TSXETY, TSXETZ, TSXWMY, TSXNTP series), and Ethernet switch modules (STB, TSXETC series). Any facility using these devices for process control, power distribution automation, or SCADA monitoring is affected.

An attacker would send HTTP requests with directory traversal sequences (e.g., ../ or URL-encoded equivalents) to the SchneiderWEB server to access files outside the web root. This could allow reading configuration files, firmware, or other sensitive data stored on the device's filesystem.