# Schneider Electric Modicon PLCs vulnerable to MitM and credential attacks

Published: 2026-05-07 · Severity: routine · Sectors: manufacturing, infrastructure
Canonical: https://vorant.io/reports/deb992ca-9fa9-5140-8fca-9445ca2418d9/schneider-electric-modicon-plcs-vulnerable-to-mitm-and-credential-attacks

> Three vulnerabilities in Schneider Electric Modicon M340, M580 PLCs and EcoStruxure software allow man-in-the-middle attacks, credential bypass, and unauthorized project access.

Schneider Electric has released CISA-coordinated advisories covering three vulnerabilities affecting its Modicon M340 and M580 programmable logic controllers (PLCs), EcoStruxure Control Expert, and EcoStruxure Process Expert DCS software. All are widely deployed in critical manufacturing environments worldwide. CVE-2023-6408 is an improper message-integrity flaw allowing man-in-the-middle attacks on port 502/TCP (Modbus) that could cause denial of service and compromise controller confidentiality and integrity. CVE-2023-6409 involves hard-coded credential handling that permits unauthorized access to password-protected project files when opened in EcoStruxure Control Expert. CVE-2023-27975 allows local users to tamper with memory on engineering workstations to extract project credentials. Affected versions span Modicon M340 firmware prior to SV3.60, M580 prior to SV4.20, M580 Safety CPUs prior to SV4.21, EcoStruxure Control Expert prior to v16.0, and EcoStruxure Process Expert prior to 2023. Fixes are available; interim mitigations include network segmentation, firewall rules blocking port 502/TCP, IPsec encryption, and memory protection activation.

## Mentioned in this report

- Vulnerabilities: CVE-2023-27975, CVE-2023-6408, CVE-2023-6409

## Detection guidance (public sample)

### Modbus/TCP Connection to Port 502 from Scripting or Recon Tooling

ATT&CK: T1040

Windows host opening outbound TCP/502 (Modbus) connections from script interpreters or scanning/relay tools rather than engineering software, consistent with interception or manipulation of unauthenticated Modbus traffic to Modicon PLCs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Modbus/TCP Connection to Port 502 from Scripting or Recon Tooling
description: Detects outbound TCP connections to port 502 (Modbus) initiated by script
  interpreters, shells or common scanning/relay tools. Modbus lacks message integrity
  (CVE-2023-6408), so adversaries on the path can read or alter controller traffic;
  legitimate engineering software is not a scripting host.
tags:
- attack.credential-access
- attack.t1040
- attack.collection
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationPort: 502
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \cmd.exe
    - \python.exe
    - \pythonw.exe
    - \wscript.exe
    - \cscript.exe
    - \nmap.exe
    - \ncat.exe
    - \nc.exe
    - \socat.exe
  condition: selection
falsepositives:
- OT engineers or integrators running Python or PowerShell Modbus test and polling
  scripts against PLCs
- Authorised OT vulnerability scans using nmap against controllers
level: medium
id: fc042865-8e28-5fee-ac97-130b40ebf810
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-03
```

### Suspicious Memory Access to EcoStruxure Control Expert Process

ATT&CK: T1555

A non-system process opens the Control Expert engineering software with memory read/write rights, matching local memory tampering used to extract project credentials (CVE-2023-27975). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Memory Access to EcoStruxure Control Expert Process
description: Detects processes opening a handle to the EcoStruxure Control Expert
  process with VM read/write or full access rights. This resembles local memory tampering
  to extract project credentials from engineering workstations. Target process name
  matching is by substring; tune to the local executable name.
tags:
- attack.credential-access
- attack.t1555
logsource:
  category: process_access
  product: windows
detection:
  selection:
    TargetImage|contains: ControlExpert
    GrantedAccess:
    - '0x1fffff'
    - '0x1f3fff'
    - '0x1410'
    - '0x1438'
    - '0x0030'
    - '0x0038'
  filter_system:
    SourceImage|startswith:
    - C:\Windows\System32\
    - C:\Windows\SysWOW64\
    - C:\Program Files\Windows Defender\
    - C:\ProgramData\Microsoft\Windows Defender\
  filter_self:
    SourceImage|contains: ControlExpert
  condition: selection and not filter_system and not filter_self
falsepositives:
- EDR or antivirus agents scanning process memory outside the excluded Defender paths
- Debuggers used by vendor support or developers on an engineering workstation
level: medium
id: 4551c074-f4e5-549e-b43c-2a7a6f3a240d
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-03
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/deb992ca-9fa9-5140-8fca-9445ca2418d9/schneider-electric-modicon-plcs-vulnerable-to-mitm-and-credential-attacks.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup