Schneider Modicon M340 modules vulnerable to FTP DoS
A crafted FTP command can crash Schneider Electric Modicon M340 controllers and communication modules, causing denial of service; patches available.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Schneider Electric, via CISA ICS advisory ICSA-26-260-04, disclosed CVE-2025-6625, an Improper Input Validation (CWE-20) flaw affecting the Modicon M340 controller and several associated communication modules (BMXNOR0200H, BMXNGD0100, BMXNOC0401, BMXNOE0100, BMXNOE0110). A specially crafted FTP command sent to an affected device can trigger a denial of service, rendering the device unavailable. Affected products span multiple firmware/software versions, including all versions of the Ethernet/Serial RTU module and M580 Global Data module, and versions prior to 3.60/6.80/SV3.70 of other listed modules.
These devices are deployed worldwide across critical infrastructure sectors including chemical, commercial facilities, critical manufacturing, energy, and water/wastewater. Schneider Electric has released vendor fixes for most affected products (BMXNOE0100 v3.60, BMXNOE0110 v6.80, Modicon M340 SV3.70, BMXNOR0200H SV1.7 IR27), each requiring a reboot to complete. A remediation plan is still pending for BMXNGD0100, BMXNOC0401, and future versions of Modicon M340 and BMXNOR0200H.
Until patches are applied, Schneider Electric and CISA recommend disabling the FTP service (disabled by default), blocking port 21/FTP via firewall/network segmentation, and using VPNs for any required remote access. No evidence of in-the-wild exploitation is noted in the advisory; this is a vendor-reported vulnerability disclosed responsibly through Schneider Electric's CPCERT.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-04
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs