// Description
# Schneider Electric Security Notification
11-Apr-23 (13-Aug-24) Document Reference Number – SEVD-2023-101-05 (v4.0.0) Page 1 of 9
# Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers)
11 April 2023 (13 August 2024)
# Overview
Schneider Electric is aware of multiple vulnerabilities in its Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers). Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way. Failure to apply the remediations and mitigations provided below may risk a denial of service of the controller, which could result in disrupted operations.
August 2024 Update: A remediation is available for Modicon M580 CPU Safety (page 2).
# Affected Products and Versions
Product CVE-2023-25619 CVE-2023-25620 Modicon M340 CPU (part numbers BMXP34*)
Versions prior to SV3.51 x xModicon M580 CPU (part numbers BMEP* and BMEH*)
Versions prior to v4.10
x xModicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)
Versions prior to SV4.21
x xModicon Momentum Unity M1E Processor (171CBU*)
All versions prior to SV2.70
x xModicon MC80 (BMKC80)
Versions prior to SV2.0 x xLegacy Modicon Quantum (140CPU65*)
All versions xLegacy Modicon Premium CPUs (TSXP57*)
All versions
x xSchneider Electric Security Notification
11-Apr-23 (13-Aug-24) Document Reference Number – SEVD-2023-101-05 (v4.0.0) Page 2 of 9
# Vulnerability Details
CVE ID: CVE-2023-25619
CVSS v3.1 Base Score 7.5 | High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when communicating over the Modbus TCP protocol. CVE ID: CVE-2023-25620
CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H