# Schneider Electric Modicon M580 communication modules stack overflow

Published: 2025-09-09 · Severity: routine · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/15c0bd6c-f29e-5aa5-a450-2c7a75ecf9f7/schneider-electric-modicon-m580-communication-modules-stack-overflow

> Stack overflow in Schneider Electric communication modules via VxWorks DHCP server; patch available, no active exploitation reported.

Schneider Electric communication modules for Modicon M580 and Quantum controllers contain an out-of-bounds write vulnerability (CVE-2021-29999) in the VxWorks DHCP server. The flaw allows remote unauthenticated attackers with low complexity to trigger a stack overflow, potentially compromising confidentiality, integrity, and availability of affected devices. CVSS v4 score is 9.3 (critical). Affected modules include BMENOC0321, BMECRA31210, BMXCRA31200, BMXCRA31210, 140CRA31200, and 140CRA31908 in versions prior to specified patch levels. CISA confirms no known public exploitation at the time of publication. Mitigation requires updating to patched firmware versions and implementing network segmentation to isolate control systems from business networks.

## Mentioned in this report

- Vulnerabilities: CVE-2021-29999

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-058-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/15c0bd6c-f29e-5aa5-a450-2c7a75ecf9f7/schneider-electric-modicon-m580-communication-modules-stack-overflow.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup