A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause denial of HTTP and FTP services when a series of specially crafted requests is sent to the controller over HTTP.

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in the Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (see security notification for affected versions), that could cause denial of HTTP and FTP services when a series of specially crafted requests is sent to the controller over HTTP.

Schneider Electric is aware of a vulnerability in its Modicon M340, Modicon Quantum and Modicon Premium legacy offers and associated communication modules. The Modicon Ethernet Programmable Automation controller products are controllers for industrial process and infrastructure. Failure to apply the remediations provided below may risk a Denial-of-Service attack, which could result in the unavailability of the web and FTP services. September 2022 update: A fix is available for Modicon M340 X80 Ethernet Communication Module BMXNOC0401