Schneider Modicon controllers vulnerable to password theft
Two CVEs in Schneider Electric Modicon M340, MC80, and Momentum Unity M1E controllers allow MitM attackers to steal password hashes and bypass authentication, risking denial of service.
Schneider Electric disclosed two vulnerabilities affecting its Modicon M340, MC80, and Momentum Unity M1E programmable automation controllers, along with the EcoStruxure Control Expert engineering application. CVE-2024-8933 enables attackers positioned on the logical network to intercept password hashes during project file uploads or downloads, while CVE-2024-8935 exploits weaknesses in the Diffie-Hellman key exchange to conduct authentication bypass via man-in-the-middle attacks during session establishment. Both flaws could result in denial of service and loss of confidentiality and integrity of industrial controllers.
Schneider Electric has released firmware updates for M340 (version 3.70) and Momentum Unity M1E (version SV2.90), as well as EcoStruxure Control Expert version 16.2 HF003. A fix for MC80 controllers is planned for future releases. Until patches are applied, Schneider recommends network segmentation, blocking unauthorized access to TCP port 502, configuring access control lists, and deploying external firewall devices.
The vulnerabilities affect critical infrastructure sectors including commercial facilities, critical manufacturing, and energy, with Schneider Electric products deployed worldwide. Kaspersky researcher Artem Zinenko and Tel Aviv University's Amir Zaltzman discovered and reported the flaws to Schneider Electric.
Mentioned in this report
Detection guidance
Modbus TCP/502 Connection from Non-Engineering Host (Potential AiTM Positioning)
Detects network connections to Modbus TCP port 502 originating from hosts other than known EcoStruxure/engineering workstations, which may indicate an attacker positioned on the logical network attempting to intercept password hashes or session traffic (CVE-2024-8933/CVE-2024-8935). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Modbus TCP/502 Connection from Non-Engineering Host
id: 6e90d539-e4b0-5655-a8d6-5b5b2911d8a5
status: experimental
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 502
filter_known_engineering:
Image|endswith:
- \UnityPro.exe
- \ControlExpert.exe
- \EcoStruxureControlExpert.exe
condition: selection and not filter_known_engineering
fields:
- Image
- SourceIp
- DestinationIp
- DestinationPort
- User
falsepositives:
- Legitimate engineering workstations not covered by the process allowlist
- Network monitoring or vulnerability scanning tools probing ICS assets
- HMI/SCADA software polling PLCs over Modbus that is not in the exclusion list
level: medium
tags:
- attack.t1557
- attack.collection
author: Vorant
Project File Upload/Download to Modicon PLC from Unusual Source Process
Detects EcoStruxure Control Expert project file transfer activity (upload/download) initiated by processes other than the standard engineering suite, which could indicate credential/password hash interception during session establishment as described in CVE-2024-8933. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Performing EcoStruxure Project File Transfer
id: ae02f539-501f-58e0-9c9a-3153325bb9bf
status: experimental
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 502
Initiated: 'true'
filter_known:
Image|endswith:
- \UnityPro.exe
- \ControlExpert.exe
- \EcoStruxureControlExpert.exe
- \svchost.exe
condition: selection and not filter_known
fields:
- Image
- CommandLine
- DestinationIp
- DestinationPort
- User
falsepositives:
- Custom automation scripts legitimately performing PLC project transfers
- Third-party ICS management tools not included in the allowlist
level: medium
tags:
- attack.t1003
- attack.credential_access
author: Vorant
Potential ARP/Name Resolution Poisoning Preceding ICS Session Hijack
Detects a host resolving or communicating with the same destination IP address via multiple differing MAC/hostname pairings in a short window, a common precursor of ARP spoofing or name resolution poisoning used to position for Modbus/EcoStruxure MITM attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Duplicate IP-to-MAC Resolution Indicative of ARP Spoofing
id: a3b8ea61-c398-5a2d-aeda-93f546ae4d3b
status: experimental
logsource:
category: network_connection
product: linux
detection:
selection:
EventType: arp_reply
condition: selection
fields:
- SourceMac
- SourceIp
- DestinationIp
falsepositives:
- Legitimate DHCP lease changes or NIC replacements on the ICS network
- Failover/HA network configurations that intentionally re-map IP-MAC pairs
level: low
tags:
- attack.t1557.001
- attack.collection
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-03
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free