PT-2024-9212 · Schneider Electric · Modicon M340 Cpu Bmxp34

Published 2024-11-12 · Updated 2024-11-13 · CVE-2024-8936

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon M340 CPU BMXP34 (affected versions not specified)

Description: The issue is related to insufficient input validation in the Modbus protocol implementation of the Schneider Electric Modicon M340 CPU BMXP34 programmable logic controller (PLC) software. This can be exploited by a remote attacker to perform a Man-In-The-Middle (MITM) attack, potentially leading to loss of confidentiality of controller memory. The attack involves sending a crafted Modbus function call to tamper with memory after a successful MITM attack.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-10900

CVE-2024-8936

Affected Products

Modicon M340 Cpu Bmxp34

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-8936 · Security Note
• https://bdu.fstec.ru/vul/2024-10900 · Security Note
• https://twitter.com/CVEnew/status/1856694185140842894 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1856609764152602844 · Twitter Post
• https://t.me/cvenotify/101505 · Telegram Post
• https://t.me/cvedetector/10801 · Telegram Post
• https://download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf · Note