What’s Vulnerable › Vulnerabilities
CVE-2023-25620
- Severity: medium (CVSS 6.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.6% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2023-04-19 · updated 2026-06-17
- Weakness: CWE-754
Description
A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when a malicious project file is loaded onto the controller by an authenticated user.
Affected products
- Schneider-Electric 140Cpu65 Firmware: all versions
- Schneider-Electric Bmeh58S Firmware: all versions
- Schneider-Electric Bmep58S Firmware: all versions
- Schneider-Electric Modicon M340 Firmware: before 3.51 — fixed in 3.51
- Schneider Electric SE Modicon M580: before 4.10 — fixed in 4.10
- Schneider-Electric Modicon Mc80 Firmware: all versions
- Schneider-Electric Modicon Momentum Unity M1E Processor Firmware: all versions
- Schneider-Electric Tsxp57 Firmware: all versions
How to fix
Upgrade to a fixed version: Schneider-Electric Modicon M340 Firmware 3.51; Schneider Electric SE Modicon M580 4.10. Check the vendor advisory for mitigations.
References
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-05.pdf
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-05.pdf
Get alerted when CVE-2023-25620 or the next vulnerability affects your stack