Skip to content
OpenAdvisories
High SEVD-2022-221-02 1 CVE

Modicon PAC Controllers

Published Aug 9, 2022 · Updated Aug 13, 2024 · Revision 5

Vendor: Schneider Electric Product: Legacy Modicon Quantum/Premium Product: Modicon M340 CPU Product: Modicon M580 CPU Product: Modicon M580 CPU Safety Product: Modicon MC80 Product: Modicon Momentum MDI CPU

Summary

Schneider Electric is aware of a vulnerability in its Modicon PAC Controllers.
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way.
Failure to apply the remediations provided below may risk memory related errors, which could result in Denial of Service of the controller when using Modbus TCP.
September 2022 Update: A remediation is available for Modicon MC80 (BMKC80) Controller
March 2023 Update: A remediation is available for Modicon Momentum Unity M1E processor and for the Modicon M580 CPU

Vulnerabilities 1

Revision history

  1. #5.0.0

    A remediation is available for the Modicon M580 CPU Safety (page 2).

  2. #4.0.0

    A remediation is available for Modicon Momentum Unity M1E processor and for the Modicon M580 CPU (page 2).

  3. #3.0.0

    The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. For specific questions or support, Customers are requested to contact Schneider Electric’s Customer Care Center.Please refer to the mitigations recommended in the section below.

  4. #2.0.0

    A remediation is available for Modicon MC80 (BMKC80) Controller

  5. #1.0.0

    Original Release

References