PatchSiren

PatchSiren cyber security CVE debrief

CVE-2024-8936 Schneider Electric CVE debrief

A CWE-20 Improper Input Validation vulnerability in Schneider Electric Modicon M340 CPU Controller firmware versions prior to SV3.65 allows an attacker to tamper with controller memory parameters after a successful Man-in-the-Middle (MitM) attack, followed by a Read Physical Memory operation. This results in loss of confidentiality of controller memory. The attack requires network access and high attack complexity (AC:H), with no privileges or user interaction needed. The vulnerability was disclosed on November 12, 2024, with firmware fixes subsequently released for related product families (MC80 in January 2026, Momentum Unity M1E in April 2025).

Vendor
Schneider Electric
Product
Modicon M340 CPU Controller
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2024-11-12
Original CVE updated
2026-01-20
Advisory published
2024-11-12
Advisory updated
2026-01-20

Who should care

Organizations operating Schneider Electric Modicon M340 PLC systems in industrial environments, particularly those with Ethernet-connected controllers accessible from operational networks or remote access pathways. Critical infrastructure operators in manufacturing, energy, water/wastewater, and building automation using Modicon M340 BMXP34* series CPUs should prioritize assessment and patching.

Technical summary

The vulnerability stems from improper input validation in the Modicon M340 CPU firmware, specifically affecting the Read Physical Memory operation. An attacker positioned as a Man-in-the-Middle can manipulate parameters to tamper with controller memory, compromising confidentiality. The attack surface is network-accessible (AV:N) but requires high complexity (AC:H) to execute. No authentication or user interaction is required. The confidentiality impact is rated HIGH (C:H) with LOW integrity impact (I:L) and no availability impact (A:N). Firmware version SV3.65 remediates this vulnerability. Network-layer mitigations include blocking TCP port 502, implementing ACLs, and enabling CPU memory protection features.

Defensive priority

medium

Recommended defensive actions

  • Upgrade Modicon M340 CPU firmware to version SV3.65 or later
  • Implement network segmentation and firewall rules to block unauthorized access to port 502/TCP
  • Configure Access Control Lists per Modicon M340 Ethernet Communications documentation
  • Enable M340 CPU memory protection by configuring the input bit to a physical input
  • Consider deploying external firewall/VPN devices such as Belden EAGLE40-07 for secure remote access
  • Apply defense-in-depth strategies for industrial control systems per CISA guidance

Evidence notes

CISA CSAF advisory ICSA-24-326-04 (initial release 2024-11-12, republished 2026-01-20) documents this vulnerability as part of Schneider Electric SEVD-2024-317-03. The CVSS 3.1 vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N yields a base score of 6.5 (MEDIUM). The vulnerability affects Modicon M340 CPU Firmware prior to SV3.65 on BMXP34* controllers. Remediation firmware SV3.65 was available at initial disclosure. Related products MC80 and Momentum Unity M1E received fixes in subsequent advisory revisions.

Official resources

2024-11-12