# Schneider Electric Modicon improper input validation flaw

Published: 2025-10-28 · Severity: routine · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/4f8cc44a-c423-5570-bf7d-8a5e2bced99a/schneider-electric-modicon-improper-input-validation-flaw

> Critical remote vulnerability in Schneider Electric Modicon controllers allows denial of service and data compromise via unauthenticated Modbus packets.

Schneider Electric Modicon industrial controllers contain an improper input validation vulnerability (CVE-2024-11737) that can be exploited remotely without authentication or user interaction. Affected products include Modicon M241, M251, M258, and LMC058 controllers. Successful exploitation leads to denial of service and loss of confidentiality and integrity within the controller when a crafted Modbus packet is sent to the device on port 502/TCP. The vulnerability carries a CVSS v4 score of 9.3, indicating critical severity.

Schneider Electric has released patched firmware versions: 5.2.11.29 for M241/M251 and 5.0.4.19 for M258/LMC058. These updates can be deployed via EcoStruxure Machine Expert and Controller Assistant. Immediate patching is strongly recommended for affected installations. In the interim, organizations should restrict network access to Modicon controllers through firewalls, disable unused protocols, implement network segmentation, and block port 502/TCP from untrusted networks. Controllers should be isolated from business networks and not directly exposed to the Internet.

CISA reports no known public exploitation of this vulnerability to date. The vulnerability affects critical infrastructure sectors including commercial facilities, critical manufacturing, and energy, with Schneider Electric products deployed worldwide.

## Mentioned in this report

- Vulnerabilities: CVE-2024-11737

## Detection guidance (public sample)

### External Source Allowed Through Firewall to Modbus Port 502/TCP

ATT&CK: T1190

Firewall allowed a connection from a non-private source address to TCP/502, which exposes Modicon controllers (CVE-2024-11737) to crafted Modbus packets from untrusted networks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: External Source Allowed Through Firewall to Modbus Port 502/TCP
description: Detects firewall-permitted traffic from public (non-RFC1918) source addresses
  to TCP/502. Modicon M241/M251/M258/LMC058 controllers are exploitable via a crafted
  Modbus packet on this port without authentication (CVE-2024-11737). Modbus should
  never be reachable from untrusted networks. For DoS attempts, also look for repeated
  hits by the same source over a short period.
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1498
logsource:
  category: firewall
detection:
  selection:
    dst_port: 502
    action:
    - allow
    - allowed
    - accept
    - accepted
  filter_internal_src:
    src_ip|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.0/8
    - 169.254.0.0/16
  condition: selection and not filter_internal_src
falsepositives:
- Approved remote-maintenance or integrator VPN egress addresses that legitimately
  reach PLCs
- Cloud-hosted SCADA or historian services polling Modbus devices over a permitted
  public path
level: high
id: 2da6de4e-81fd-527f-bf4a-c7fe113b6d08
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04
```

### Scripting or Network Utility Process Connecting to Modbus Port 502

ATT&CK: T1190

A scripting interpreter or raw network tool on a Windows host opened an outbound connection to TCP/502, consistent with hand-crafted Modbus traffic sent to a PLC. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scripting or Network Utility Process Connecting to Modbus Port 502
description: Detects scripting interpreters and raw network utilities making outbound
  connections to TCP/502 (Modbus). Crafted Modbus packets can exploit improper input
  validation in Schneider Modicon controllers (CVE-2024-11737), causing DoS or loss
  of integrity. Legitimate Modbus clients are normally dedicated engineering or SCADA
  software, not shells or generic interpreters.
tags:
- attack.initial-access
- attack.t1190
- attack.impact
- attack.t1498
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 502
    Image|endswith:
    - \python.exe
    - \pythonw.exe
    - \powershell.exe
    - \pwsh.exe
    - \cscript.exe
    - \wscript.exe
    - \nc.exe
    - \ncat.exe
    - \cmd.exe
  condition: selection
falsepositives:
- Engineers or integrators running Python or PowerShell Modbus test scripts from a
  sanctioned engineering workstation
- Custom monitoring or data-collection scripts that poll PLCs over Modbus
level: medium
id: d8d52ae0-849d-5c5b-bded-29092de0b399
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-352-04

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4f8cc44a-c423-5570-bf7d-8a5e2bced99a/schneider-electric-modicon-improper-input-validation-flaw.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup