Main Vulnerability Database Vulnerabilities #VU101039

Improper Enforcement of Message Integrity During Transmission in a Communication Channel in Schneider Electric products - CVE-2023-6408

Published: November 29, 2024

Vulnerability identifier: #VU101039

CSH Severity: High

CVSS v4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-6408

CWE-ID: CWE-924

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper enforcement of message integrity during transmission in a communication channel. A remote attacker can perform a man-in-the-middle (MitM) attack and execute arbitrary code on the system.

Affected software

Modicon MC80
Modicon Momentum Unity M1E Processor
Modicon M340
Modicon M580
Modicon M580 CPU Safety

How to mitigate CVE-2023-6408

Install updates from vendor's website.

Modicon M340 - update to 3.60
Modicon M580 - update to 4.20
Modicon M580 CPU Safety - update to 4.21

External References

Related Security Bulletins

Multiple vulnerabilities in Schneider Electric EcoStruxure Control Expert, EcoStruxure Process Expert and Modicon M340, M580 and M580 Safety PLCs