Skip to content
OpenAdvisories
High ICSA-25-035-06 1 CVE

Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H (Update B)

Published Jan 14, 2025 · Updated Jun 9, 2026 · Revision 4

Vendor: Schneider Electric Product: Ethernet / Serial RTU Module Product: Modbus/TCP Ethernet Modicon M340 FactoryCast module Product: Modbus/TCP Ethernet Modicon M340 module Product: Modicon M340 processors

Summary

Schneider Electric is aware of a vulnerability in its Web Server on Modicon M340 and BMXNOE0100/0110,
BMXNOR0200H communication modules products.
The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network
communication modules used with Modicon M340. BMXNOR0200H is a communication module that enables
M580 and M340 platforms to use RTU protocol exchange with RTU stations.
Failure to apply the remediation/mitigations provided below may risk information disclosure on web pages,
modification of web pages and denial of serviceClick or tap here to enter text., which could result in the
unavailability of the controllers or modules.
August Update: Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon M340 module)
and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)

Vulnerabilities 1

Revision history

  1. #4

    CISA Republication update based on Schneider Electric CPCERT SEVD-2025-014-05 advisory

  2. #3

    Remediation is available for Modicon M340

  3. #2

    Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon M340 module) and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)

  4. #1

    Original Release

References