639 matches found
CISA Releases Six Industrial Control Systems Advisories
CISA released six Industrial Control Systems ICS advisories on April 17, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-107-01 Schneider Electric Trio Q Licensed Data Radio ICSA-25-107-02 Schneider Electric...
Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H Exposure of Sensitive Information to an Unauthorized Actor (CVE-2024-12142)
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked. This plugin only works...
CVE-2022-45789
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert All Versions, EcoStruxure Process Expert All Versions...
CVE-2022-45788
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert All...
CVE-2022-37301
A CWE-191: Integer Underflow Wrap or Wraparound vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU part numbers BMXP34V3.40 and prior, Modicon M580 CPU part numbers BME...
CISA Releases Nine Industrial Control Systems Advisories
CISA released nine Industrial Control Systems ICS advisories on February 4, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-035-01 Western Telematic Inc NPS Series, DSM Series, CPM Series ICSA-25-035-02 Rockwe...
Schneider Electric Modicon M340 信息泄露漏洞
The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric France. An information disclosure vulnerability exists in the Schneider Electric Modicon M340, which stems from the inclusion of an Exposure of...
Vulnerabilities fixed in Schneider Electric Modicon
Schneider Electric has fixed vulnerabilities in Modicon M340, M580 and various communication modules. A malicious party could exploit the vulnerabilities to cause a denial-of-service or gain access to system data and possibly affect the operation of the controllers. For successful abuse, the...
Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H (Update B)
RISK EVALUATION Successful exploitation of this vulnerability could cause information disclosure of a restricted web page, modification of a web page and a denial of service when specific web pages are modified and restricted functions are invoked. 2. RECOMMENDED PRACTICES CISA reminds...
The vulnerability of the Modbus protocol implementation in Schneider Electric Modicon M340 CPU BMXP34 programmable logic controllers allows a perpetrator to carry out a “man-in-the-middle” attack.
The vulnerability of the Modbus protocol implementation in Schneider Electric Modicon M340 CPU BMXP34 programmable logic controllers is related to insufficient verification of input data. Exploiting this vulnerability can allow an attacker to carry out a “man-in-the-middle” attack remotely...
The vulnerability of microprogrammed software for Schneider Electric Modicon M340 CPU BMXP34, Modicon MC80 BMKC80, and Modicon Momentum Unity M1E Processor 171CBU lies in the lack of checks for the integrity of messages during transmission over communication channels. This allows attackers to disclose sensitive information or cause malfunctions in the system.
The vulnerability of microprogrammed logic controllers PLCs from Schneider Electric, such as the Modicon M340 CPU BMXP34, Modicon MC80 BMKC80, and Modicon Momentum Unity M1E Processor 171CBU, stems from the lack of checks for the integrity of messages during transmission over communication...
The vulnerability of the Diffie-Hellman algorithm in microprogrammed logic controllers (PLCs) from Schneider Electric Modicon M340 CPU BMXP34 allows a attacker to execute a “man-in-the-middle” attack.
The vulnerability of the Diffie-Hellman algorithm in microprogrammed logic controllers PLCs from Schneider Electric Modicon M340 CPU BMXP34 lies in the ability to bypass authentication through spoofing. Exploiting this vulnerability allows a malicious actor to carry out a “man-in-the-middle” atta...
Schneider Electric Modicon M340, MC80, and Momentum Unity M1E Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVE-2024-8933)
A vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themselves inside the logical network while a valid user uploads or downloads a project...
Schneider Electric Modicon M340, MC80, and Momentum Unity M1E Authentication Bypass By Spoofing (CVE-2024-8935)
A vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers when conducting a Man-In-The-Middle attack between the controller and the engineering workstation while a valid user is establishing a communication session. This vulnerability is...
Schneider Electric Modicon M340, MC80, and Momentum Unity M1E Improper Restriction of Operations Within the Bounds of a Memory Buffer (CVE-2024-8938)
Arbitrary code execution can potentially be achieved after a successful Man-In-The Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in memory size computation. This plugin only works with Tenable.ot. Please visit...
The vulnerability of the Modbus protocol implementation in Schneider Electric’s programmable logic controllers (PLCs), such as the Modicon M340 CPU BMXP34, Modicon MC80 BMKC80, and Modicon Momentum Unity M1E Processor 171CBU, allows a attacker to execute a “man-in-the-middle” attack.
The vulnerability of the Modbus protocol implementation in Schneider Electric’s programmable logic controllers PLCs such as Modicon M340 CPU BMXP34, Modicon MC80 BMKC80, and Modicon Momentum Unity M1E Processor 171CBU lies in the execution of operations outside the buffer in memory. Exploiting th...
Schneider Electric Modicon M340 输入验证错误漏洞
The Schneider Electric Modicon M340 is a mid-range PLC Programmable Logic Controller for industrial processes and infrastructure from Schneider Electric France. An input validation error vulnerability exists in the Schneider Electric Modicon M340, which stems from the presence of an improper inpu...
Schneider Electric Modicon M340 缓冲区错误漏洞
The Schneider Electric Modicon M340 is a mid-range PLC Programmable Logic Controller for industrial processes and infrastructure from Schneider Electric France. The Schneider Electric Modicon M340 suffers from a buffer error vulnerability that originates from improperly restricted memory buffer...
Schneider Electric Modicon M340 安全漏洞
The Schneider Electric Modicon M340 is a medium-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric, France. A security vulnerability exists in the Schneider Electric Modicon M340 that arises from improper implementation of message integrity...
Schneider Electric Modicon M340 安全漏洞
The Schneider Electric Modicon M340 is a mid-range PLC Programmable Logic Controller for industrial processes and infrastructure from Schneider Electric France. A security vulnerability exists in the Schneider Electric Modicon M340 that stems from the presence of an authentication bypass via...