Skip to content
OpenAdvisories
High ICSA-24-331-03 3 CVEs

Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert, and Modicon M340, M580 and M580 Safety PLCs

Published Feb 13, 2024 · Updated May 7, 2026 · Revision 5

Vendor: Schneider Electric Product: EcoStruxure Control Expert Product: EcoStruxure™ Process Expert Product: Modicon M340 CPU (part numbers BMXP34*) Product: Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) Product: Modicon M580 CPU Safety Product: Modicon MC80 (part numbers BMKC80) Product: Modicon Momentum Unity M1E Processor Controller Product: Modicon Momentum Unity M1E Processor Firmware

Summary

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Control Expert ,
EcoStruxure Process Expert and Modicon M340, M580 PLCs (Programmable Logic
Controllers).
Modicon PLCs control and monitor industrial operations. EcoStruxure Control Expert is the
common programming, debugging and operating software for Modicon PLCs. EcoStruxure
Process Expert DCS is a single automation system to engineer, operate, and maintain an entire
plant Infrastructure.
Failure to apply the remediations provided below may risk unauthorized access to your PLC,
which could result in the possibility of denial of service and loss of confidentiality, integrity of the
controller.

Note regarding vulnerability details: The severity of vulnerabilities was calculated using the
CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and
Environmental metrics. Schneider Electric recommends that customers score the CVSS
Environmental metrics, which are specific to end-user organizations, and consider factors such
as the presence of mitigations in that environment. Environmental metrics may refine the
relative severity posed by the vulnerabilities described in this document within a customer’s
environment

Vulnerabilities 3

Revision history

  1. #5

    CISA Republication update based on Schneider Electric CPCERT SEVD-2024-044-01 advisory

  2. #4

    Remediation is available for Modicon Momentum controller

  3. #3

    A remediation is available for the Modicon M580 CPU Safety (page 3).

  4. #2

    Modicon MC80 and Momentum M1E PLCs have been identified as impacted by the CVE-2023-6408. Mitigations are now available

  5. #1

    Original Release

References