Vulnerability · Published Feb 14, 2024 · Assigned by schneider
CVE-2023-6408
High 8.1
In plain English
A high-severity security flaw in EcoStruxure Control Expert from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 75.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Modicon M340 CPU (part numbers BMXP34*) | Versions prior to sv3.60 |
| Schneider Electric | Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) | Versions prior to sv4.20 |
| Schneider Electric | Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) | All Versions |
| Schneider Electric | EcoStruxure Control Expert | Versions prior to v16.0 |
| Schneider Electric | EcoStruxure Process Expert | Versions prior to v2023 |
Weakness: CWE-924 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H