Schneider Modicon controllers vulnerable to password theft
Two CVEs in Schneider Electric Modicon M340, MC80, and Momentum Unity M1E controllers allow MitM attackers to steal password hashes and bypass authentication, risking denial of service.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Schneider Electric disclosed two vulnerabilities affecting its Modicon M340, MC80, and Momentum Unity M1E programmable automation controllers, along with the EcoStruxure Control Expert engineering application. CVE-2024-8933 enables attackers positioned on the logical network to intercept password hashes during project file uploads or downloads, while CVE-2024-8935 exploits weaknesses in the Diffie-Hellman key exchange to conduct authentication bypass via man-in-the-middle attacks during session establishment. Both flaws could result in denial of service and loss of confidentiality and integrity of industrial controllers.
Schneider Electric has released firmware updates for M340 (version 3.70) and Momentum Unity M1E (version SV2.90), as well as EcoStruxure Control Expert version 16.2 HF003. A fix for MC80 controllers is planned for future releases. Until patches are applied, Schneider recommends network segmentation, blocking unauthorized access to TCP port 502, configuring access control lists, and deploying external firewall devices.
The vulnerabilities affect critical infrastructure sectors including commercial facilities, critical manufacturing, and energy, with Schneider Electric products deployed worldwide. Kaspersky researcher Artem Zinenko and Tel Aviv University's Amir Zaltzman discovered and reported the flaws to Schneider Electric.
Mentioned in this report
Detection guidance
Modbus TCP/502 Connection from Non-Engineering Host (Potential AiTM Positioning)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects network connections to Modbus TCP port 502 originating from hosts other than known EcoStruxure/engineering workstations, which may indicate an attacker positioned on the logical network attempting to intercept password hashes or session traffic (CVE-2024-8933/CVE-2024-8935). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Modbus TCP/502 Connection from Non-Engineering Host
id: 6e90d539-e4b0-5655-a8d6-5b5b2911d8a5
status: experimental
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 502
filter_known_engineering:
Image|endswith:
- \UnityPro.exe
- \ControlExpert.exe
- \EcoStruxureControlExpert.exe
condition: selection and not filter_known_engineering
fields:
- Image
- SourceIp
- DestinationIp
- DestinationPort
- User
falsepositives:
- Legitimate engineering workstations not covered by the process allowlist
- Network monitoring or vulnerability scanning tools probing ICS assets
- HMI/SCADA software polling PLCs over Modbus that is not in the exclusion list
level: medium
tags:
- attack.t1557
- attack.collection
author: Vorant
Project File Upload/Download to Modicon PLC from Unusual Source Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects EcoStruxure Control Expert project file transfer activity (upload/download) initiated by processes other than the standard engineering suite, which could indicate credential/password hash interception during session establishment as described in CVE-2024-8933. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Process Performing EcoStruxure Project File Transfer
id: ae02f539-501f-58e0-9c9a-3153325bb9bf
status: experimental
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 502
Initiated: 'true'
filter_known:
Image|endswith:
- \UnityPro.exe
- \ControlExpert.exe
- \EcoStruxureControlExpert.exe
- \svchost.exe
condition: selection and not filter_known
fields:
- Image
- CommandLine
- DestinationIp
- DestinationPort
- User
falsepositives:
- Custom automation scripts legitimately performing PLC project transfers
- Third-party ICS management tools not included in the allowlist
level: medium
tags:
- attack.t1003
- attack.credential-access
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-03
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs