Schneider Electric Modicon M340 Controller and Communication Modules
Plan PatchCVSS 7.5ICS-CERT ICSA-26-260-04Aug 12, 2025
Schneider ElectricEnergy
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Schneider Electric Modicon M340 controller and associated communication modules contain an input validation vulnerability (CWE-20) in their network processing. A remote attacker can send malformed packets that cause the device to crash or become unresponsive, resulting in denial of service. Affected modules include the Ethernet/Serial RTU module, Modbus/TCP Ethernet modules, EtherNet/IP modules, and M580 Global Data modules. The vulnerability can be exploited via network access without authentication.
What this means
What could happen
An attacker with network access to the Modicon M340 controller or communication modules could send malformed input that crashes the device, causing loss of control over your processes and requiring manual intervention to recover. This is a denial of service vulnerability affecting critical control devices.
Who's at risk
Water authorities and municipal electric utilities with Schneider Electric Modicon M340 programmable automation controllers or their communication modules (BMXNOR0200H Ethernet/Serial RTU Module, BMXNOE0100 Modbus/TCP module, BMXNOE0110 FactoryCast Ethernet module, BMXNOC0401 EtherNet/IP and Modbus/TCP module, or BMXNGD0100 M580 Global Data module) should review this advisory. These are critical control devices that manage process logic and network communication in industrial plants.
How it could be exploited
An attacker on your network (or reachable via the internet if the device is not behind a firewall) sends specially crafted network packets to the affected Modicon M340 controller or one of its communication modules. The device fails to properly validate the input, crashes, and stops responding to legitimate commands from your engineering workstations and SCADA systems. No authentication or special credentials are required.
Prerequisites
- Network access to the Modicon M340 controller or communication module on ports 21 (FTP) or Modbus/TCP port 502
- Device must be running an affected firmware version
remotely exploitableno authentication requiredlow complexityaffects critical control infrastructurecauses denial of service to control devices
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Affected products (6)
4 with fix2 pending
ProductAffected VersionsFix Status
M580 Global Data module All versionsAll versionsNo fix yet
Modicon M340 X80 Ethernet Communication modules All versionsAll versionsNo fix yet
Remediation & Mitigation
0/7
Do now
0/2WORKAROUNDDisable FTP service on all Modicon M340 devices and communication modules if not actively required for operations
HARDENINGConfigure firewall rules to block access to FTP port 21 and Modbus/TCP port 502 from untrusted networks
Schedule — requires maintenance window
0/4Patching may require device reboot — plan for process interruption
Modicon M340 Controller
HOTFIXUpdate Modicon M340 Controller to firmware version SV3.70 or later
Modbus/TCP Ethernet Modicon M340 module
HOTFIXUpdate Modbus/TCP Ethernet Modicon M340 module (BMXNOE0100) to firmware version 3.60 or later
Modbus/TCP Ethernet Modicon M340 FactoryCast module
HOTFIXUpdate Modbus/TCP Ethernet Modicon M340 FactoryCast module (BMXNOE0110) to firmware version 6.80 or later
All products
HOTFIXUpdate Ethernet/Serial RTU Module (BMXNOR0200H) to firmware version SV1.7_IR27 or later
Long-term hardening
0/1Modicon M340 Controller
HARDENINGImplement network segmentation to isolate Modicon M340 controllers and communication modules on a dedicated control network separated from corporate IT
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/a2651e31-ce35-4560-b04e-fbd9d6d29c52Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.