Schneider Electric Modicon M340 Controller and Communication Modules: 1 CVE, High 7.5

Summary

CISA reports 1 vulnerability in Schneider Electric Modicon M340 Firmware, Modicon M340 Controller, Ethernet / Serial RTU Module, M580 Global Data module and 3 more. Weakness type: Improper Input Validation. Schneider Electric is aware of a vulnerability in its Modicon M340 https://www.se.com/ww/en/product-range/1468-modicon-m340-pac/, BMXNOR0200H https://www.se.com/us/en/product/BMXNOR0200H/communication-module-modicon-m340-iec-608705101-104-dnp3-for-severe-environments/: Modicon M340 X80 Ethernet… Highest CVSS v3 score: 7.5 (High), exploitable over the network.

At a glance

Vendor

Schneider Electric

Products

Modicon M340 Firmware, Modicon M340 Controller, Ethernet / Serial RTU Module, M580 Global Data module, Modicon M340 X80 Ethernet Communication modules, Modbus/TCP Ethernet Modicon M340 module, Modbus/TCP Ethernet Modicon M340 FactoryCast module

CVEs

CVE-2025-6625

Highest CVSS v3

7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Highest CVSS v4

–

Known exploited (KEV)

No CVE from this advisory is on the KEV list as of the last refresh

Sectors (per CISA)

Chemical, Commercial Facilities, Critical Manufacturing, Energy, Water and Wastewater Systems

Deployed

Worldwide

Vendor HQ

France

Vulnerabilities

Affected products (11)

• Modicon M340 Firmware Versions prior to SV3.70
• Modicon M340 Firmware Version SV3.70
• Modicon M340 Controller
• Ethernet / Serial RTU Module All versions
• Ethernet / Serial RTU Module version SV1.7 IR27
• M580 Global Data module All versions
• Modicon M340 X80 Ethernet Communication modules All versions
• Modbus/TCP Ethernet Modicon M340 module Versions prior to 3.60
• Modbus/TCP Ethernet Modicon M340 module Version 3.60
• Modbus/TCP Ethernet Modicon M340 FactoryCast module Versions prior to 6.80
• Modbus/TCP Ethernet Modicon M340 FactoryCast module Version 6.80

Vendor fixes and mitigations (from advisory)

• Vendor Fix: Version 3.60 of BMXNOE0100 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0100/networkmodule-modicon-m340-modbus-tcp-1-x-rj45-flash-memorycard/ Reboot is needed to complete the firmware upgrade link
• Vendor Fix: Version 6.80 of BMXNOE0110 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0110/ethernettcp-ip-network-module-modicon-m340-automation-platformflash-memory-card-internal-ram-16-mb-1-x-rj45-10-100/ Reboot is needed to complete the firmware upgrade link
• Vendor Fix: Version SV3.70 of Modicon M340 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware link
• Vendor Fix: Version SV1.7 IR27 of BMXNOR0200H includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOR0200H/ethernet-serial-rtu-module-2-x-rj45/ link
• Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • FTP service is disabled by default • Ensure to disable FTP service when not in use • Setup network segmentation and implement a firewall to block all unauthorized access to ports 21/FTP • Use VPN (Virtual Private Networks) tunnels if remote access is required
• Mitigation: Schneider Electric is establishing a remediation plan for all future versions of • Modicon M340 • BMXNOR0200H • BMXNGD0100 • BMXNOC401 We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • FTP service is disabled by default • Ensure to disable FTP service when not in use • Setup network segmentation and implement a firewall to block all unauthorized access to ports 21/FTP • Use VPN (Virtual Private Networks) tunnels if remote access is required

Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.

Sources

• CISA advisory ICSA-26-260-04
• Machine-readable CSAF record
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Secur
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-224-05&p_enDocType=Secur
• https://www.se.com/ww/en/download/document/7EN52-0390/

This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.