Schneider Electric Modicon M340, BMXNOE0100, and BMXNOE0110 Files or Directories Accessible to External Parties (CVE-2024-5056)

medium Tenable OT Security Plugin ID 502368

Synopsis

The remote OT asset is affected by a vulnerability.

Description

CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

Modbus/TCP Ethernet Modicon M340 module: Version SV3.60 of BMXNOE0100 includes a fix for this vulnerability and is available for download here.

Modbus/TCP Ethernet Modicon M340 FactoryCast module: Version SV6.80 of BMXNOE0110 includes a fix for this vulnerability and is available for download here.

Schneider Electric is establishing a remediation plan for all future versions of Modicon M340 that will include a fix for this vulnerability. They will provide an update when the remediation is available. Until then, users should immediately apply the following mitigations to reduce the risk of exploit:

- Set up network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the devices.
- FTP service is disabled by default. Deactivate the FTP service after use when not needed.
- Configure the Access Control List following the recommendations of the user manual "Modicon M340 for Ethernet Communications Modules and Processors User Manual" in chapter "Messaging Configuration Parameters".

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2024-163-01, SEVD-2024-163-01 CSAF Version.

Plugin Details

Severity: Medium

ID: 502368

File Name: tenable_ot_schneider_CVE-2024-5056.nasl

Version: 1.5

Type: remote

Family: Tenable.ot

Published: 8/26/2024

Updated: 2/14/2026

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 2.5

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2024-5056

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:schneider-electric:modicon_m340_bmxnoe0110_firmware, cpe:/o:schneider-electric:modicon_m340_firmware, cpe:/o:schneider-electric:modicon_m340_bmxnoe0100_firmware

Required KB Items: Tenable.ot/Schneider

Exploit Ease: No known exploits are available

Patch Publication Date: 6/12/2024

Vulnerability Publication Date: 6/12/2024

Reference Information

CVE: CVE-2024-5056

CWE: 552

Detections

Analytics