CVE-2023-25620

mediumpriority · track · 26EPSS 0.006 · 48 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.59% (48th) EPSS

CVSS 6.5 · medium

Is it mine?

22 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller when a malicious project file is loaded onto the controller by an authenticated user.

cvss

Technical severity, 0–10. One row per scoring source.

6.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 3.6

v3.16.5mediumAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:Hsecondary · cybersecurity@se.comexploitability 2.8 · impact 3.6

v3.16mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-754USCWE-754US

affected products (22)

Products and version ranges known to be affected.

Schneider Electric Legacy Modicon Premium CPUs (TSXP57*)≤ Allenisa_euvdEU
Schneider Electric Legacy Modicon Quantum (140CPU65*)≤ Allenisa_euvdEU
Schneider Electric Modicon M340 CPU (part numbers BMXP34*)≤ prior to SV3.51enisa_euvdEU
Schneider Electric Modicon M580 CPU (part numbers BMEP* and BMEH*)≤ prior to V4.10enisa_euvdEU
Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)≤ Allenisa_euvdEU
Schneider Electric Modicon MC80 (BMKC80)≤ Allenisa_euvdEU
Schneider Electric Modicon Momentum Unity M1E Processor (171CBU*)≤ Allenisa_euvdEU
Schneider Electric Legacy Modicon Premium CPUsall versionsfstec_bduRU
Schneider Electric Legacy Modicon Quantumall versionsfstec_bduRU
Schneider Electric Modicon M340 CPU BMXP34≤ 3.51fstec_bduRU
Schneider Electric Modicon M580 CPU≤ 4.10fstec_bduRU
Schneider Electric Modicon M580 CPU Safetyall versionsfstec_bduRU
Schneider Electric Modicon MC80 (BMKC80)all versionsfstec_bduRU
Schneider Electric Modicon Momentum Unity M1E Processorall versionsfstec_bduRU
schneider-electric 140cpu65 firmwareall versionsnvdUScpe:2.3:o:schneider-electric:140cpu65_firmware:*:*:*:*:*:*:*:*
schneider-electric bmeh58s firmwareall versionsnvdUScpe:2.3:o:schneider-electric:bmeh58s_firmware:*:*:*:*:*:*:*:*
schneider-electric bmep58s firmwareall versionsnvdUScpe:2.3:o:schneider-electric:bmep58s_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon m340 firmware< 3.51nvdUScpe:2.3:o:schneider-electric:modicon_m340_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon m580 firmware< 4.10nvdUScpe:2.3:o:schneider-electric:modicon_m580_firmware:*:*:*:*:*:*:*:*
schneider-electric modicon mc80 firmwareall versionsnvdUScpe:2.3:o:schneider-electric:modicon_mc80_firmware:*:*:*:*:*:*:*:*

showing 20 of 22

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd NVD CVE.org MITRE

published 2023-04-19modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan