Description
CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers when conducting a Man-In-The-Middle attack between the controller and the engineering workstation while a valid user is establishing a communication session. This vulnerability is inherent to Diffie Hellman algorithm which does not protect against Man-In-The-Middle attacks.
Scores
CVSS v3
7.5
EPSS
0.0003
EPSS Percentile
6.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-290
Status
published
Products (3)
Schneider Electric/Modicon M340 CPU (part numbers BMXP34*)
All versions since SV3.60
Schneider Electric/Modicon MC80 (part numbers BMKC80)
All versions
Schneider Electric/Modicon Momentum Unity M1E Processor (171CBU*)
All Versions
Published
Nov 13, 2024
Tracked Since
Feb 18, 2026