Schneider Electric Modicon improper input validation flaw
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Critical remote vulnerability in Schneider Electric Modicon controllers allows denial of service and data compromise via unauthenticated Modbus packets.
Schneider Electric Modicon industrial controllers contain an improper input validation vulnerability (CVE-2024-11737) that can be exploited remotely without authentication or user interaction. Affected products include Modicon M241, M251, M258, and LMC058 controllers. Successful exploitation leads to denial of service and loss of confidentiality and integrity within the controller when a crafted Modbus packet is sent to the device on port 502/TCP. The vulnerability carries a CVSS v4 score of 9.3, indicating critical severity.
Schneider Electric has released patched firmware versions: 5.2.11.29 for M241/M251 and 5.0.4.19 for M258/LMC058. These updates can be deployed via EcoStruxure Machine Expert and Controller Assistant. Immediate patching is strongly recommended for affected installations. In the interim, organizations should restrict network access to Modicon controllers through firewalls, disable unused protocols, implement network segmentation, and block port 502/TCP from untrusted networks. Controllers should be isolated from business networks and not directly exposed to the Internet.
CISA reports no known public exploitation of this vulnerability to date. The vulnerability affects critical infrastructure sectors including commercial facilities, critical manufacturing, and energy, with Schneider Electric products deployed worldwide.
Mentioned in this report
Detection guidance
External Source Allowed Through Firewall to Modbus Port 502/TCP
Firewall allowed a connection from a non-private source address to TCP/502, which exposes Modicon controllers (CVE-2024-11737) to crafted Modbus packets from untrusted networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: External Source Allowed Through Firewall to Modbus Port 502/TCP
description: Detects firewall-permitted traffic from public (non-RFC1918) source addresses
to TCP/502. Modicon M241/M251/M258/LMC058 controllers are exploitable via a crafted
Modbus packet on this port without authentication (CVE-2024-11737). Modbus should
never be reachable from untrusted networks. For DoS attempts, also look for repeated
hits by the same source over a short period.
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1498
logsource:
category: firewall
detection:
selection:
dst_port: 502
action:
- allow
- allowed
- accept
- accepted
filter_internal_src:
src_ip|cidr:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
- 127.0.0.0/8
- 169.254.0.0/16
condition: selection and not filter_internal_src
falsepositives:
- Approved remote-maintenance or integrator VPN egress addresses that legitimately
reach PLCs
- Cloud-hosted SCADA or historian services polling Modbus devices over a permitted
public path
level: high
id: 2da6de4e-81fd-527f-bf4a-c7fe113b6d08
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04
Scripting or Network Utility Process Connecting to Modbus Port 502
A scripting interpreter or raw network tool on a Windows host opened an outbound connection to TCP/502, consistent with hand-crafted Modbus traffic sent to a PLC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripting or Network Utility Process Connecting to Modbus Port 502
description: Detects scripting interpreters and raw network utilities making outbound
connections to TCP/502 (Modbus). Crafted Modbus packets can exploit improper input
validation in Schneider Modicon controllers (CVE-2024-11737), causing DoS or loss
of integrity. Legitimate Modbus clients are normally dedicated engineering or SCADA
software, not shells or generic interpreters.
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1498
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 502
Image|endswith:
- \python.exe
- \pythonw.exe
- \powershell.exe
- \pwsh.exe
- \cscript.exe
- \wscript.exe
- \nc.exe
- \ncat.exe
- \cmd.exe
condition: selection
falsepositives:
- Engineers or integrators running Python or PowerShell Modbus test scripts from a
sanctioned engineering workstation
- Custom monitoring or data-collection scripts that poll PLCs over Modbus
level: medium
id: d8d52ae0-849d-5c5b-bded-29092de0b399
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,571 reports from 145 sources, 595 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs