Description
CWE-924: Improper Enforcement of Message Integrity During Transmission in a
Communication Channel vulnerability exists that could cause a denial of service and loss of
confidentiality, integrity of controllers when conducting a Man in the Middle attack.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Modicon M340 CPU (part numbers BMXP34*) | Versions prior to sv3.60 | — |
| Schneider Electric | Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) | Versions prior to sv4.20 | — |
| Schneider Electric | Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) | All Versions | — |
| Schneider Electric | EcoStruxure Control Expert | Versions prior to v16.0 | — |
| Schneider Electric | EcoStruxure Process Expert | Versions prior to v2023 | — |
Advisories 2
- SEVD-2024-044-01 EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 Safety PLCs Schneider Electric CPCERT · Sep 8, 2026
- ICSA-24-331-03 Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert, and Modicon M340, M580 and M580 Safety PLCs CISA ICS & IT advisories · May 7, 2026