Schneider Electric Modicon Controllers (Update B)

An attacker could read configuration files, control logic, and other sensitive data directly from your PLC without needing credentials. This could expose how your process is controlled and give an attacker the information needed to plan further attacks on your systems.

Operators and engineers maintaining Modicon M241, M251, M258, and LMC058 PLCs in energy generation/distribution and manufacturing environments. These controllers are used for performance-demanding machine automation and process control applications.

An attacker with network access to the Modicon controller can send requests to read arbitrary files from the device storage. Since no authentication is required, the attacker does not need credentials or physical access. The attacker could extract program logic, setpoints, or other operational data to inform further attacks against the plant.