Schneider Electric Modicon PLCs vulnerable to MitM and credential attacks
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Three vulnerabilities in Schneider Electric Modicon M340, M580 PLCs and EcoStruxure software allow man-in-the-middle attacks, credential bypass, and unauthorized project access.
Schneider Electric has released CISA-coordinated advisories covering three vulnerabilities affecting its Modicon M340 and M580 programmable logic controllers (PLCs), EcoStruxure Control Expert, and EcoStruxure Process Expert DCS software. All are widely deployed in critical manufacturing environments worldwide. CVE-2023-6408 is an improper message-integrity flaw allowing man-in-the-middle attacks on port 502/TCP (Modbus) that could cause denial of service and compromise controller confidentiality and integrity. CVE-2023-6409 involves hard-coded credential handling that permits unauthorized access to password-protected project files when opened in EcoStruxure Control Expert. CVE-2023-27975 allows local users to tamper with memory on engineering workstations to extract project credentials. Affected versions span Modicon M340 firmware prior to SV3.60, M580 prior to SV4.20, M580 Safety CPUs prior to SV4.21, EcoStruxure Control Expert prior to v16.0, and EcoStruxure Process Expert prior to 2023. Fixes are available; interim mitigations include network segmentation, firewall rules blocking port 502/TCP, IPsec encryption, and memory protection activation.
Mentioned in this report
Detection guidance
Modbus/TCP Connection to Port 502 from Scripting or Recon Tooling
Windows host opening outbound TCP/502 (Modbus) connections from script interpreters or scanning/relay tools rather than engineering software, consistent with interception or manipulation of unauthenticated Modbus traffic to Modicon PLCs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Modbus/TCP Connection to Port 502 from Scripting or Recon Tooling
description: Detects outbound TCP connections to port 502 (Modbus) initiated by script
interpreters, shells or common scanning/relay tools. Modbus lacks message integrity
(CVE-2023-6408), so adversaries on the path can read or alter controller traffic;
legitimate engineering software is not a scripting host.
tags:
- attack.credential-access
- attack.t1040
- attack.collection
logsource:
category: network_connection
product: windows
detection:
selection:
Initiated: 'true'
DestinationPort: 502
Image|endswith:
- \powershell.exe
- \pwsh.exe
- \cmd.exe
- \python.exe
- \pythonw.exe
- \wscript.exe
- \cscript.exe
- \nmap.exe
- \ncat.exe
- \nc.exe
- \socat.exe
condition: selection
falsepositives:
- OT engineers or integrators running Python or PowerShell Modbus test and polling
scripts against PLCs
- Authorised OT vulnerability scans using nmap against controllers
level: medium
id: fc042865-8e28-5fee-ac97-130b40ebf810
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-03
Suspicious Memory Access to EcoStruxure Control Expert Process
A non-system process opens the Control Expert engineering software with memory read/write rights, matching local memory tampering used to extract project credentials (CVE-2023-27975). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Memory Access to EcoStruxure Control Expert Process
description: Detects processes opening a handle to the EcoStruxure Control Expert
process with VM read/write or full access rights. This resembles local memory tampering
to extract project credentials from engineering workstations. Target process name
matching is by substring; tune to the local executable name.
tags:
- attack.credential-access
- attack.t1555
logsource:
category: process_access
product: windows
detection:
selection:
TargetImage|contains: ControlExpert
GrantedAccess:
- '0x1fffff'
- '0x1f3fff'
- '0x1410'
- '0x1438'
- '0x0030'
- '0x0038'
filter_system:
SourceImage|startswith:
- C:\Windows\System32\
- C:\Windows\SysWOW64\
- C:\Program Files\Windows Defender\
- C:\ProgramData\Microsoft\Windows Defender\
filter_self:
SourceImage|contains: ControlExpert
condition: selection and not filter_system and not filter_self
falsepositives:
- EDR or antivirus agents scanning process memory outside the excluded Defender paths
- Debuggers used by vendor support or developers on an engineering workstation
level: medium
id: 4551c074-f4e5-549e-b43c-2a7a6f3a240d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-03
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs