Skip to content
OpenAdvisories
Critical ICSA-25-058-01 1 CVE

Schneider Electric communication modules for Modicon M580 and Quantum controllers (Update B)

Published Feb 27, 2025 · Updated Sep 9, 2025 · Revision 3

Vendor: Schneider Electric Product: 140CRA31200 (Quantum RIO Drop) 140CRA31200 Product: 140CRA31908 (M580 Quantum S908 RIO Drop Adapter) 140CRA31908 Product: Modicon M580 communication modules BMECRA BMECRA31210 Product: Modicon M580 communication modules BMENOC BMENOC0321 Product: Modicon M580/Quantum communication modules BMXCRA BMXCRA31200 Product: Modicon M580/Quantum communication modules BMXCRA BMXCRA31210

Summary

Successful exploitation of this vulnerability could allow a stack overflow attack, which could result in loss of confidentiality, integrity, and denial of service of the device.

Vulnerabilities 1

  • Unscored —
    CVE-2021-29999

    An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.

Revision history

  1. #3

    Update B - Remediations are available for 140CRA31200 (Quantum RIO Drop) and 140CRA31908 (M580 Quantum S908 RIO Drop Adapter)

  2. #2

    Update A - A remediation is now available for BMECRA31210, BMXCRA31200, and BMXCRA31210.

  3. #1

    Initial Publication

References