Description
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could
cause information disclosure of restricted web page, modification of web page and denial of
service when specific web pages are modified and restricted functions are invoked.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Schneider Electric | Modicon M340 processors (part numbers BMXP34*) | All versions | — |
| Schneider Electric | BMXNOE0100 | All versions | — |
| Schneider Electric | BMXNOE0110 | All Versions | — |
| Schneider Electric | BMXNOR0200H | Versions prior to SV1.70IR26 | — |
Advisories 3
- ICSA-25-035-06 Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H (Update B) CISA ICS & IT advisories · Jun 9, 2026
- SEVD-2025-014-05 Web Server on Modicon M340, Modbus/TCP Ethernet Modicon M340 module, Modbus/TCP Ethernet Modicon M340 FactoryCast module and Ethernet / Serial RTU communication modules Schneider Electric CPCERT · Apr 14, 2026
- NCSC-2025-0019 Kwetsbaarheden verholpen in Schneider Electric Modicon NCSC-NL (Netherlands) · Jan 16, 2025