CVE-2023-6408

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-02-14 · updated 2026-06-17
Weakness: CWE-924

Description

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack.

Affected products

Schneider Electric EcoStruxure Control Expert: before 16.0 — fixed in 16.0
Schneider Electric EcoStruxure Process Expert: before 2023 — fixed in 2023
Schneider-Electric Modicon M340 Bmxp341000 Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp341000H Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp342000 Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp3420102 Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp3420102Cl Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp342010 Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp342020 Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp342020H Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp3420302 Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp3420302Cl Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp3420302H Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp342030 Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M340 Bmxp342030H Firmware: before 3.60 — fixed in 3.60
Schneider-Electric Modicon M580 Bmeh582040 Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmeh582040C Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmeh582040S Firmware: before 4.21 — fixed in 4.21
Schneider-Electric Modicon M580 Bmeh584040 Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmeh584040C Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmeh584040S Firmware: before 4.21 — fixed in 4.21
Schneider-Electric Modicon M580 Bmeh586040 Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmeh586040C Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmeh586040S Firmware: before 4.21 — fixed in 4.21
Schneider-Electric Modicon M580 Bmep581020 Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmep581020H Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmep582020 Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmep582020H Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmep582040 Firmware: before 4.20 — fixed in 4.20
Schneider-Electric Modicon M580 Bmep582040H Firmware: before 4.20 — fixed in 4.20

How to fix

Upgrade to a fixed version: Schneider Electric EcoStruxure Control Expert 16.0; Schneider Electric EcoStruxure Process Expert 2023; Schneider-Electric Modicon M340 Bmxp341000 Firmware 3.60; Schneider-Electric Modicon M340 Bmxp341000H Firmware 3.60; Schneider-Electric Modicon M340 Bmxp342000 Firmware 3.60; Schneider-Electric Modicon M340 Bmxp3420102 Firmware 3.60; Schneider-Electric Modicon M340 Bmxp3420102Cl Firmware 3.60; Schneider-Electric Modicon M340 Bmxp342010 Firmware 3.60; Schneider-Electric Modicon M340 Bmxp342020 Firmware 3.60; Schneider-Electric Modicon M340 Bmxp342020H Firmware 3.60; Schneider-Electric Modicon M340 Bmxp3420302 Firmware 3.60; Schneider-Electric Modicon M340 Bmxp3420302Cl Firmware 3.60. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-6408 or the next vulnerability affects your stack