Schneider Electric Modicon Controllers RCE via Modbus
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Multiple improper access control flaws in Schneider Modicon PACs allow remote code execution over Modbus; apply firmware patches or firewall port 502.
Schneider Electric has published a CISA advisory detailing multiple vulnerabilities affecting its Modicon line of programmable automation controllers (PACs) used in critical infrastructure including energy, manufacturing, and commercial facilities. The primary vulnerability, CVE-2019-6808, is an improper access control flaw that permits remote code execution by overwriting controller configuration settings over the unencrypted Modbus protocol (TCP port 502). A related issue, CVE-2018-7847, creates a similar risk with potential for denial of service or code execution through configuration overwrites. CVE-2018-7849 introduces an uncaught exception via improper data integrity checks when transferring files over Modbus, risking controller unavailability. CVE-2018-7850 allows display of invalid information in the engineering software due to reliance on untrusted inputs. Affected products include the M580, M340, MC80, Quantum, Premium, and Momentum Unity M1E controller lines; Quantum and Premium variants have reached end-of-life with no fixes planned. The advisory does not indicate active exploitation in the wild, but the vectors are straightforward for an attacker with network access to port 502.
Mentioned in this report
Detection guidance
Scripting or LOLBin Process Connecting to Modbus TCP Port 502
Script interpreters or living-off-the-land binaries opening outbound connections to TCP/502, consistent with scripted Modbus writes or configuration overwrites against Modicon PACs (CVE-2019-6808, CVE-2018-7847). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Scripting or LOLBin Process Connecting to Modbus TCP Port 502
id: 68ce697d-c716-5548-ac58-713c4a9925c0
status: experimental
description: Detects script interpreters and LOLBins making outbound connections to
TCP port 502 (Modbus). Modbus has no authentication, so exploitation of Modicon
controllers (e.g. CVE-2019-6808 configuration overwrite) is typically done with
custom scripts or tools rather than vendor engineering software. Triage by destination
- a known PLC/PAC address from a non-engineering host is suspicious.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-01
tags:
- attack.initial-access
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 502
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \python.exe
- \pythonw.exe
- \cscript.exe
- \wscript.exe
- \mshta.exe
- \rundll32.exe
- \cmd.exe
condition: selection
falsepositives:
- OT engineers or integrators running Python or PowerShell Modbus test or polling
scripts from engineering workstations
- SCADA data-collection scripts that poll controllers over Modbus
level: medium
author: Vorant
Modbus TCP Port 502 Connection from User-Writable Directory Process
A process running from a user-writable path (AppData, Temp, Users\Public, ProgramData) connecting to TCP/502, suggesting unauthorised tooling interacting with Modbus controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Modbus TCP Port 502 Connection from User-Writable Directory Process
id: 1d975fc1-a16b-5e5f-b602-84e29f7d020f
status: experimental
description: Detects outbound connections to TCP port 502 (Modbus) from executables
located in user-writable directories. Vendor engineering software and legitimate
SCADA clients are normally installed under Program Files, so Modbus traffic from
temp/profile paths indicates ad-hoc or malicious tooling targeting PACs such as
Modicon M580/M340 (CVE-2019-6808).
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-01
tags:
- attack.initial-access
- attack.t1190
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 502
Image|contains:
- \AppData\
- \Temp\
- \Users\Public\
- \ProgramData\
condition: selection
falsepositives:
- Portable Modbus diagnostic or simulator tools run by OT staff from a profile or
temp directory
- Per-user installs of SCADA or HMI clients under AppData
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-01
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs