# Schneider Electric Modicon Controllers RCE via Modbus

Published: 2026-04-23 · Severity: routine · Sectors: energy, manufacturing, infrastructure
Canonical: https://vorant.io/reports/62f4788e-3354-5564-aa79-65f6445f5f90/schneider-electric-modicon-controllers-rce-via-modbus

> Multiple improper access control flaws in Schneider Modicon PACs allow remote code execution over Modbus; apply firmware patches or firewall port 502.

Schneider Electric has published a CISA advisory detailing multiple vulnerabilities affecting its Modicon line of programmable automation controllers (PACs) used in critical infrastructure including energy, manufacturing, and commercial facilities. The primary vulnerability, CVE-2019-6808, is an improper access control flaw that permits remote code execution by overwriting controller configuration settings over the unencrypted Modbus protocol (TCP port 502). A related issue, CVE-2018-7847, creates a similar risk with potential for denial of service or code execution through configuration overwrites. CVE-2018-7849 introduces an uncaught exception via improper data integrity checks when transferring files over Modbus, risking controller unavailability. CVE-2018-7850 allows display of invalid information in the engineering software due to reliance on untrusted inputs. Affected products include the M580, M340, MC80, Quantum, Premium, and Momentum Unity M1E controller lines; Quantum and Premium variants have reached end-of-life with no fixes planned. The advisory does not indicate active exploitation in the wild, but the vectors are straightforward for an attacker with network access to port 502.

## Mentioned in this report

- Vulnerabilities: CVE-2018-7847, CVE-2018-7849, CVE-2018-7850, CVE-2019-6808

## Detection guidance (public sample)

### Scripting or LOLBin Process Connecting to Modbus TCP Port 502

ATT&CK: T1190

Script interpreters or living-off-the-land binaries opening outbound connections to TCP/502, consistent with scripted Modbus writes or configuration overwrites against Modicon PACs (CVE-2019-6808, CVE-2018-7847). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scripting or LOLBin Process Connecting to Modbus TCP Port 502
id: 68ce697d-c716-5548-ac58-713c4a9925c0
status: experimental
description: Detects script interpreters and LOLBins making outbound connections to
  TCP port 502 (Modbus). Modbus has no authentication, so exploitation of Modicon
  controllers (e.g. CVE-2019-6808 configuration overwrite) is typically done with
  custom scripts or tools rather than vendor engineering software. Triage by destination
  - a known PLC/PAC address from a non-engineering host is suspicious.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-01
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 502
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \pythonw.exe
    - \cscript.exe
    - \wscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \cmd.exe
  condition: selection
falsepositives:
- OT engineers or integrators running Python or PowerShell Modbus test or polling
  scripts from engineering workstations
- SCADA data-collection scripts that poll controllers over Modbus
level: medium
author: Vorant
```

### Modbus TCP Port 502 Connection from User-Writable Directory Process

ATT&CK: T1190

A process running from a user-writable path (AppData, Temp, Users\Public, ProgramData) connecting to TCP/502, suggesting unauthorised tooling interacting with Modbus controllers. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Modbus TCP Port 502 Connection from User-Writable Directory Process
id: 1d975fc1-a16b-5e5f-b602-84e29f7d020f
status: experimental
description: Detects outbound connections to TCP port 502 (Modbus) from executables
  located in user-writable directories. Vendor engineering software and legitimate
  SCADA clients are normally installed under Program Files, so Modbus traffic from
  temp/profile paths indicates ad-hoc or malicious tooling targeting PACs such as
  Modicon M580/M340 (CVE-2019-6808).
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-01
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 502
    Image|contains:
    - \AppData\
    - \Temp\
    - \Users\Public\
    - \ProgramData\
  condition: selection
falsepositives:
- Portable Modbus diagnostic or simulator tools run by OT staff from a profile or
  temp directory
- Per-user installs of SCADA or HMI clients under AppData
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-114-01

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/62f4788e-3354-5564-aa79-65f6445f5f90/schneider-electric-modicon-controllers-rce-via-modbus.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup