Improper Input Validation in Schneider Electric Modicon M340 Modules

Schneider Electric has disclosed a vulnerability (CVE-2025-6625) affecting multiple Modicon M340 controller and communication modules. The flaw stems from improper input validation in the device's FTP service, which is susceptible to denial-of-service (DoS) attacks. An unauthenticated remote attacker can send a specially crafted FTP command to an affected device, causing it to crash or become unresponsive, leading to operational unavailability.

The vulnerability impacts a wide range of modules, including the BMXNOR0200H, BMXNGD0100, BMXNOC0401, BMXNOE0100, and BMXNOE0110, as well as the core M340 controller firmware. Given the deployment of these devices in critical infrastructure sectors like energy, water and wastewater, and manufacturing, the impact of service disruption is significant. Schneider Electric has released firmware updates for several modules and recommends disabling FTP services or implementing strict network segmentation if patching is not immediately feasible.

Impact

Successful exploitation results in a Denial of Service (DoS), rendering the affected industrial controller unavailable. This poses a high risk to critical infrastructure sectors - including energy, water, wastewater, and chemical manufacturing - where device uptime is essential for safe operations. There are no reports of remote code execution or data exfiltration associated with this specific vulnerability.

Recommendation

• Apply the vendor-provided firmware updates immediately to affected modules:
• Update BMXNOE0100 to version 3.60 or later.
• Update BMXNOE0110 to version 6.80 or later.
• Update Modicon M340 controller firmware to version SV3.70 or later.
• Update BMXNOR0200H to version SV1.7 IR27 or later.
• Disable the FTP service on all Modicon M340 modules if it is not required for operational tasks.
• Implement strict network segmentation and firewall rules to block unauthorized access to TCP port 21 on all industrial devices.
• Require the use of VPNs for any necessary remote maintenance or monitoring access to the control network.
• Ensure controllers are kept in locked cabinets and are not left in "Program" mode during standard operation.