All CISA Advisories, EN

Schneider Electric Modicon M340 Controller and Communication Modules

View CSAF

1. EXECUTIVE SUMMARY

  • CVSS v4 8.7
  • ATTENTION: Exploitable remotely/low attack complexity
  • Vendor: Schneider Electric
  • Equipment: Modicon M340 and Communication Modules
  • Vulnerability: Improper Input Validation

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Schneider Electric reports that the following products are affected:

  • Modicon M340: All versions
  • BMXNOR0200H Ethernet/Serial RTU Module: All versions
  • BMXNGD0100 M580 Global Data module: All versions
  • BMXNOC0401 Modicon M340 X80 Ethernet Communication modules: All versions
  • BMXNOE0100 Modbus/TCP Ethernet Modicon M340 module: Versions prior to 3.60
  • BMXNOE0110 Modbus/TCP Ethernet Modicon M340 FactoryCast module: Versions prior to 6.80

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER INPUT VALIDATION CWE-20

Improper Input Validation vulnerability exists that could cause a Denial-of-Service when specially crafted FTP command is sent to the device.

CVE-2025-6625 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.5 has been calculated; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

A CVSS v4 score has also been calculated for CVE-2025-6625. A base score of 8.7 has been calculated; the CVSS vector string is (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N).

3

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.

This article has been indexed from All CISA Advisories

Read the original article: