A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modbus functions on the controller when hijacking an authenticated Modbus session. Affected Products: EcoStruxure Control Expert (All Versions), EcoStruxure Process Expert (All Versions), Modicon M340 CPU - part numbers BMXP34* (All Versions), Modicon M580 CPU - part numbers BMEP* and BMEH* (All Versions), Modicon M580 CPU Safety - part numbers BMEP58*S and BMEH58*S (All Versions)
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
EcoStruxure Control Expert
Vendor
Schneider Electric
Product
EcoStruxure Control Expert
Platforms
Unknown
Default status
unaffected
EcoStruxure Control Expert · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All Versions
affected
Unavailable
Unavailable
Unavailable
None listed
EcoStruxure Process Expert
Vendor
Schneider Electric
Product
EcoStruxure Process Expert
Platforms
Unknown
Default status
unaffected
EcoStruxure Process Expert · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All Versions
affected
Unavailable
Unavailable
Unavailable
None listed
Modicon M340 CPU (part numbers BMXP34*)
Vendor
Schneider Electric
Product
Modicon M340 CPU (part numbers BMXP34*)
Platforms
Unknown
Default status
unaffected
Modicon M340 CPU (part numbers BMXP34*) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All Versions
affected
Unavailable
Unavailable
Unavailable
None listed
Modicon M580 CPU (part numbers BMEP* and BMEH*)
Vendor
Schneider Electric
Product
Modicon M580 CPU (part numbers BMEP* and BMEH*)
Platforms
Unknown
Default status
unaffected
Modicon M580 CPU (part numbers BMEP* and BMEH*) · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
All Versions
affected
Unavailable
Unavailable
Unavailable
None listed
Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)
Vendor
Schneider Electric
Product
Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)
Platforms
Unknown
Default status
unaffected
Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) · Scoped product and version facts