Schneider Electric Modicon M340 Controller and Communication Modules

1. Executive summary

Schneider Electric has published advisory SEVD-2025-224-05, republished by CISA as ICSA-26-260-04, covering CVE-2025-6625, an improper input validation flaw (CWE-20) in the Modicon M340 controller and its associated communication modules. A crafted FTP command sent to an affected device causes a denial of service, making the device unavailable. CVSS v3.1 base score is 7.5 (HIGH), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H: network-reachable, no privileges or user interaction required, availability-only impact. No CISA-KEV exploitation state is recorded for this CVE in the verified reference data, which resolved no entries for this item. The affected products are deployed in chemical, commercial facilities, critical manufacturing, energy, and water and wastewater sectors worldwide; EMEA financial services exposure is indirect, through building management, data centre infrastructure, and third-party facilities operators running Schneider automation kit.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The vulnerability is a vendor-published flaw with no reported exploitation, no incident, and no financial-sector entity identified as affected; a generic "patching is required" trigger does not engage the articles in the regulatory reference. Clients operating these controllers as part of facilities or data centre infrastructure should handle the fix through their standard ICT asset and patch management processes.

3. Technical analysis & attack chain

CVE-2025-6625 is an improper input validation flaw (CWE-20) in the FTP service of the affected devices. The confirmed attack chain is short:

1. The attacker reaches the FTP service on an affected device over the network. The CVSS vector (AV:N, AC:L, PR:N, UI:N) confirms this is remotely exploitable with no authentication and no user interaction.
2. The attacker sends a specific crafted FTP command to the device.
3. The device suffers a denial of service and becomes unavailable.

That is the full extent of the confirmed chain. The advisory does not describe code execution, persistence, privilege escalation, or any follow-on capability: the impact metric is A:H with C:N and I:N, so the flaw crashes or hangs the device but does not, on the vendor's description, give the attacker control of it. The advisory does not name the specific FTP command, the FTP port, or the firmware component that fails to validate the input, so those details are unavailable in the source material. The advisory also does not state whether the denial of service persists until a manual reboot or clears on its own.

Affected products and versions, per the CISA advisory:

Two caveats on the table. First, for BMXNGD0100 and BMXNOC0401 the advisory lists no fixed version: Schneider states it is establishing a remediation plan for BMXNOC0401 and will update the document when it is available, and gives no equivalent statement for BMXNGD0100. Devices of those two types remain exposed to the flaw until Schneider ships a fix. Second, the revision history shows the vendor advisory has been updated three times since its original release on 2025-08-12 (remediation for the M340 on 2026-04-14, for BMXNOR0200H on 2026-08-11, and the CISA republication on 2026-09-17), so clients who triaged this advisory at first publication should re-check affected and fixed versions against the current revision.

The FTP service is disabled by default on these devices, per the vendor mitigation text. Exposure therefore requires an operator to have enabled FTP, which is common where FTP is used for firmware transfer or configuration backup.

4. Mitigation & containment

P1, within 24 hours: inventory for the six affected part numbers (BMXNOR0200H, BMXNGD0100, BMXNOC0401, BMXNOE0100, BMXNOE0110, and M340 controllers) across owned and third-party-operated facilities, and check whether the FTP service is enabled on any of them. Where FTP is enabled and not required, disable it. The vendor states the service is disabled by default, so an enabled FTP service is itself a configuration finding worth recording.

P1, within 24 hours: for devices where FTP must stay enabled, block FTP traffic to the device at the network layer, restricting access to specific management workstations or an OT management zone. The attack is a single unauthenticated crafted command, so any device with a reachable FTP port on a shared network is one packet away from an outage.

P2, within 72 hours: apply the vendor firmware fixes. BMXNOE0100 to version 3.60, BMXNOE0110 to version 6.80, M340 controllers to SV3.70, and BMXNOR0200H to SV1.7 IR27. A reboot is needed to complete the firmware upgrade on BMXNOE0100 and BMXNOE0110; schedule the outage window accordingly, since the upgrade itself takes the device down briefly. Firmware is available from the Schneider Electric product pages linked in the advisory.

P2, within 72 hours: for BMXNGD0100 and BMXNOC0401, which have no fix available, record the devices as carrying an unpatched network-reachable denial of service and compensate with the FTP disablement and segmentation controls above. Schneider has committed to updating the advisory with a BMXNOC0401 remediation plan; monitor SEVD-2025-224-05 for the update.

P3, within 7 days: confirm network segmentation between OT/automation networks and corporate networks is in place and documented for all sites running this kit, per the vendor's mitigation guidance, and fold the part numbers into the asset baseline so future Schneider advisories can be matched automatically.

5. Indicators of compromise

No indicators of compromise available in the source material. The advisory describes a vulnerability, not an exploitation campaign, and publishes no hashes, network indicators, or exploit artefacts. The observable of interest is operational rather than atomic: unexplained device unavailability on the affected part numbers, particularly where the FTP service is enabled. The source gives no FTP command string, so detection of the malicious command itself is not possible from this material.

6. Detection

Insufficient indicators to author detection rules. The advisory names no FTP command strings, no file artefacts, no registry keys, and no network signatures; the only behavioural signal is device unavailability following a crafted FTP command, and the command itself is unspecified in the source.

7. Sources

• CISA, Schneider Electric Modicon M340 Controller and Communication Modules, ICSA-26-260-04, https://www.cisa.gov/news-events/ics-advisories/icsa-26-260-04, 2026-09-17 (CISA republication of Schneider Electric CPCERT SEVD-2025-224-05, original release 2025-08-12)
• Schneider Electric, Modicon M340 Controller and Communication Modules, SEVD-2025-224-05, referenced via the CISA advisory above (CSAF and PDF versions linked from that page)

8. Adverse Trace position

We assess this as a moderate-severity availability issue, not a compromise risk: CVE-2025-6625 is a 7.5 HIGH network-reachable unauthenticated denial of service with no confidentiality or integrity impact, no recorded exploitation in the verified reference data, and an attack surface that requires the FTP service to be enabled when the vendor ships it disabled by default. The practical risk to EMEA financial services clients is concentrated in facilities and data centre automation: an M340 or its communication modules crashing takes the controlled physical process with it, and the two part numbers with no fix available, BMXNGD0100 and BMXNOC0401, extend the exposure window indefinitely. The advisory is single-sourced, from the vendor via CISA republication, which is the expected sourcing for a pre-exploitation vendor advisory and is sufficient for the vulnerability facts here; there is no third-party technical analysis to corroborate the mechanism, and no attribution is claimed or implied. We will monitor SEVD-2025-224-05 for the promised BMXNOC0401 remediation and for any BMXNGD0100 fix, and will reissue if exploitation is observed or a CISA-KEV entry appears.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.