Skip to content
OpenAdvisories
High SEVD-2022-221-04 1 CVE

Modicon PAC Controllers

Published Aug 9, 2022 · Updated Aug 13, 2024 · Revision 6

Vendor: Schneider Electric Product: Legacy Modicon Quantum Product: Modicon M340 CPU Product: Modicon M580 CPU Product: Modicon M580 CPU Safety Product: Modicon MC80 Product: Modicon MOMENTUM CPU

Summary

Schneider Electric is aware of a vulnerability in its Modicon PAC Controllers.
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient and protected way.
Failure to apply the remediations provided below may risk read access to memory content of the controllers, which could result in exposure of sensitive information such as application password hash and project data to the attacker.
September 2022 Update: The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

Vulnerabilities 1

Revision history

  1. #4.0.0

    Remediation for the Modicon M580 CPU is available for download (page 2).

  2. #5.0.0

    A remediation is available for the Modicon M580 CPU Safety (page 2).

  3. #3.0.0

    The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

  4. #2.0.0

    A clarification was added to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 V4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document

  5. #1.1.0

    The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

  6. #1.0.0

    Original Release

References