Description
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)
Affected Platforms
Schneider-Electric Modicon M580 Bmep581020 FirmwareSchneider-Electric Modicon M580 Bmep586040C FirmwareSchneider-Electric Modicon M580 Bmep582020 FirmwareSchneider-Electric Modicon M340 Bmxp3420102 FirmwareSchneider-Electric Modicon M580 Bmep585040C FirmwareSchneider-Electric Modicon M580 Bmep581020HSchneider-Electric Modicon M580 Bmeh582040S FirmwareSchneider-Electric Modicon M340 Bmxp3420302HSchneider-Electric Modicon M580 Bmep581020Schneider-Electric Modicon M580 Bmep583040 Firmware