# Schneider Electric Modicon controllers vulnerable to MITM and RCE

Published: 2026-01-20 · Severity: routine · Sectors: manufacturing, energy, infrastructure
Canonical: https://vorant.io/reports/42c6522a-d269-5f11-adc0-44921c9b57d9/schneider-electric-modicon-controllers-vulnerable-to-mitm-and-rce

> Three Schneider Electric industrial controller products contain input validation and buffer overflow flaws requiring MITM to exploit, threatening confidentiality and availability.

Schneider Electric has disclosed three vulnerabilities affecting its Modicon M340, MC80, and Momentum Unity M1E industrial automation controllers used in critical manufacturing, energy, and commercial facilities worldwide. CVE-2024-8936 is an improper input validation flaw allowing tampering of controller memory and loss of confidentiality after a successful man-in-the-middle attack followed by read operations on physical memory. CVE-2024-8937 and CVE-2024-8938 are buffer overflow vulnerabilities (CWE-119) enabling arbitrary code execution when an attacker conducts a MITM attack and sends crafted Modbus commands to tamper with authentication function calls or memory-size evaluation routines. All three require network access to port 502/TCP and successful interception of communications; there is no evidence of in-the-wild exploitation. Vendor patches are available: Modicon M340 firmware SV3.65, Modicon MC80 firmware SV2.1, and Momentum firmware SV2.80. Organizations unable to patch immediately should implement network segmentation, firewalls blocking port 502/TCP, access control lists per user manuals, enable memory protection features, and consider external firewall appliances like Belden EAGLE40-07 for VPN encapsulation.

## Mentioned in this report

- Vulnerabilities: CVE-2024-8936, CVE-2024-8937, CVE-2024-8938

## Detection guidance (public sample)

### Scripting Interpreter or LOLBin Opening Modbus/TCP Connection on Port 502

ATT&CK: T1059

Script hosts and shell interpreters making outbound connections to TCP/502 can indicate crafted Modbus traffic aimed at PLCs such as Modicon controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scripting Interpreter or LOLBin Opening Modbus/TCP Connection on Port 502
description: Detects scripting interpreters and living-off-the-land binaries initiating
  outbound connections to TCP/502 (Modbus/TCP). Crafted Modbus commands sent to Modicon
  M340/MC80/Momentum controllers (CVE-2024-8936/8937/8938) would be sent this way
  after a MITM position is obtained. Legitimate engineering software normally uses
  dedicated vendor binaries, not shells or script hosts.
status: experimental
tags:
- attack.execution
- attack.t1059
- attack.lateral-movement
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 502
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \python.exe
    - \pythonw.exe
  condition: selection
falsepositives:
- OT engineers or integrators running Python or PowerShell Modbus test scripts from
  a commissioning workstation
- Internal monitoring or asset-inventory scripts that poll PLCs over Modbus
level: medium
id: cccc4a7b-daa1-52e9-9f1e-faf2e8640324
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-04
```

### Modbus Client or Scanner Tooling Executed from Command Line

ATT&CK: T1190

Execution of Modbus client libraries, polling utilities or Nmap Modbus scripts that can be used to probe and send crafted commands to exposed controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Modbus Client or Scanner Tooling Executed from Command Line
description: Detects command lines invoking common Modbus client/scanner tooling (pymodbus,
  mbpoll, modpoll, modbus-cli, Nmap modbus-discover, Metasploit modbus modules). These
  are used to enumerate controllers and to send crafted Modbus requests to port 502,
  the precondition for the Modicon buffer overflow and memory tampering flaws.
status: experimental
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_tools:
  - Image|endswith:
    - \mbpoll.exe
    - \modpoll.exe
    - \modbus-cli.exe
  - CommandLine|contains:
    - pymodbus
    - modbus-discover
    - modbus-cli
    - modbus_client
    - modbusclient
  selection_nmap:
    Image|endswith: \nmap.exe
    CommandLine|contains: modbus
  condition: 1 of selection_*
falsepositives:
- Authorized OT assessments and commissioning activity using Modbus test tools
- Developers working with the pymodbus library on engineering workstations
level: medium
id: 4cc28177-51f1-511e-b383-0e1140ef2f28
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-04
```

### ARP Spoofing or MITM Tool Execution on Windows Host

ATT&CK: T1557

Execution of well-known MITM tools such as Ettercap or Bettercap, which could be used to intercept Modbus traffic to controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ARP Spoofing or MITM Tool Execution on Windows Host
description: Detects execution of common adversary-in-the-middle tooling (Ettercap,
  Bettercap, arpspoof, Cain) by image name or characteristic arguments. The Modicon
  vulnerabilities require the attacker to first intercept Modbus communications, typically
  via ARP spoofing on the control network.
status: experimental
tags:
- attack.credential-access
- attack.collection
- attack.t1557
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith:
    - \ettercap.exe
    - \bettercap.exe
    - \arpspoof.exe
    - \cain.exe
  selection_args:
    CommandLine|contains|all:
    - arp.spoof
    - set
  condition: 1 of selection_*
falsepositives:
- Authorized red-team or OT security assessments on the control network
- Network troubleshooting by engineers using Ettercap in a lab
level: high
id: 9fd71b92-8a59-5038-926d-747fadb519ba
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-04
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/42c6522a-d269-5f11-adc0-44921c9b57d9/schneider-electric-modicon-controllers-vulnerable-to-mitm-and-rce.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup