CVE-2018-7846

A CWE-501: Trust Boundary Violation vulnerability on connection to the Controller exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum and Modicon Premium which could cause unauthorized access by conducting a brute force attack on Modbus protocol to the controller...

CISA Releases Thirteen Industrial Control Systems Advisories

CISA released thirteen Industrial Control Systems ICS advisories on May 20, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-140-01 ABUP IoT Cloud Platform ICSA-25-140-02 National Instruments Circuit Design Sui...

Schneider Electric多款产品 安全漏洞

Schneider Electric Modicon Controllers M241 and others are products of Schneider Electric, a French company.Schneider Electric Modicon Controllers M241 is a micro PLC. Schneider Electric Modicon Controllers M251 is a micro PLC.Schneider Electric Modicon Controllers M258 is a micro PLC.Schneider...

PT-2025-21143 · Schneider Electric · Modicon Controllers M241 +3

Name of the Vulnerable Software and Affected Versions: Modicon Controllers M241 / M251 versions prior to 5.3.12.48 Modicon Controllers M258 / LMC058 all versions Description: A vulnerability exists that could cause a loss of confidentiality when an unauthenticated attacker manipulates the...

CISA Releases Seven Industrial Control Systems Advisories

CISA released seven Industrial Control Systems ICS advisories on April 24, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-114-01 Schneider Electric Modicon Controllers ICSA-25-114-02 ALBEDO Telecom Net.Time -...

CISA Releases Five Industrial Control Systems Advisories

CISA released five Industrial Control Systems ICS advisories on April 22, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-112-01 Siemens TeleControl Server Basic SQL ICSA-25-112-02 Siemens TeleControl Server...

CISA Releases Six Industrial Control Systems Advisories

CISA released six Industrial Control Systems ICS advisories on April 17, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-107-01 Schneider Electric Trio Q Licensed Data Radio ICSA-25-107-02 Schneider Electric...

CISA Releases Seven Industrial Control Systems Advisories

CISA released seven Industrial Control Systems ICS advisories on March 18, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-077-01 Schneider Electric EcoStruxure Power Automation System User Interface EPAS-UI...

CISA Releases Two Industrial Control Systems Advisories

CISA released two Industrial Control Systems ICS advisories on February 27, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-058-01 Schneider Electric Communication Modules for Modicon M580 and Quantum...

Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H Exposure of Sensitive Information to an Unauthorized Actor (CVE-2024-12142)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked. This plugin only works...

Schneider Electric Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC Incorrect Calculation of Buffer Size (CVE-2024-11425)

CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticated user is sending a crafted HTTPS packet to the webserver. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot fo...

CVE-2022-45789

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert All Versions, EcoStruxure Process Expert All Versions...

CVE-2022-45788

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller. Affected Products: EcoStruxure Control Expert All...

CVE-2022-37301

A CWE-191: Integer Underflow Wrap or Wraparound vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol. Affected products: Modicon M340 CPU part numbers BMXP34V3.40 and prior, Modicon M580 CPU part numbers BME...

Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert, and Modicon M340, M580 and M580 Safety PLCs Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVE-2023-6408)

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack. This plugin only works with Tenable.ot...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on February 4, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-25-035-01 Western Telematic Inc NPS Series, DSM Series, CPM Series ICSA-25-035-02 Rockwe...

The vulnerability of the microprogrammed software used in Modicon M580 programmable logic controllers and the EVLink Pro AC charging stations relates to incorrect calculations of the size of the allocated buffer. This vulnerability allows a intruder to cause malfunctions in the equipment.

The vulnerability of the microprogrammed software used in Modicon M580 programmable logic controllers and the EVLink Pro AC charging stations is related to incorrect calculations of the size of the buffer space allocated. Exploiting this vulnerability allows a malicious actor to cause service...

Schneider Electric Modicon M580 安全漏洞

The Schneider Electric Modicon M580 is a programmable automation controller from Schneider Electric France. A security vulnerability exists in the Schneider Electric Modicon M580 that stems from the inclusion of a buffer size miscalculation vulnerability that could result in a denial of service o...

Schneider Electric Modicon M340 信息泄露漏洞

The Schneider Electric Modicon M340 is a mid-range PLC programmable logic controller for industrial processes and infrastructure from Schneider Electric France. An information disclosure vulnerability exists in the Schneider Electric Modicon M340, which stems from the inclusion of an Exposure of...

Vulnerabilities fixed in Schneider Electric Modicon

Schneider Electric has fixed vulnerabilities in Modicon M340, M580 and various communication modules. A malicious party could exploit the vulnerabilities to cause a denial-of-service or gain access to system data and possibly affect the operation of the controllers. For successful abuse, the...