Summary
Schneider Electric is aware of a vulnerability within the VxWorks Operating System from Wind
River. Many vendors, including Schneider Electric, embed VxWorks in their offers.
If successfully exploited, these vulnerabilities could result in loss of confidentiality, integrity and
denial of service in the BMENOC0321 https://www.se.com/ww/en/product/BMENOC0321/m580-noc-control/ , BMECRA https://www.se.com/ww/en/product/BMECRA31210 and 140CRA products which are
communication modules for Modicon M580 and Quantum controllers.
Failure to apply the mitigations and remediations provided below may risk stack overflow attack,
which could result in loss of confidentiality, integrity and denial of service of the device.
Vulnerabilities 1
-
Unscored —
An issue was discovered in Wind River VxWorks through 6.8. There is a possible stack overflow in dhcp server.
Revision history
-
#3.0.0
Remediations are available for 140CRA31200 (Quantum RIO Drop) and 140CRA31908 (M580 Quantum S908 RIO Drop Adapter)
-
#2.0.0
A remediation is now available for BMECRA31210, BMXCRA31200, and BMXCRA31210
-
#1.0.0
Original Release
References
-
Wind River VxWorks DHCP Server Vulnerability - SEVD-2025-014-03 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-03.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390