CVE-2024-11737
criticalpriority · track · 0EPSS 0.006 · 50 %ileEUNLRUUSEPSS · scored 2026-10-23
CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedModicon Controllers LMC058cisa_csaf_ot
Modicon M258/LMC058 Firmware version 5.0.4.19 includes a fix for this vulnerability and can be downloaded here: https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot.
https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware - FixedModicon Controllers M241cisa_csaf_ot
Modicon M241/M251 Firmware version 5.2.11.29 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application that is part of EcoStruxure Machine Expert: https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ By using Controller Assistant update Modicon Controller M241/M251 to the latest Firmware and perform reboot.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - FixedModicon Controllers M251cisa_csaf_ot
Modicon M241/M251 Firmware version 5.2.11.29 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application that is part of EcoStruxure Machine Expert: https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ By using Controller Assistant update Modicon Controller M241/M251 to the latest Firmware and perform reboot.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ - FixedModicon Controllers M258cisa_csaf_ot
Modicon M258/LMC058 Firmware version 5.0.4.19 includes a fix for this vulnerability and can be downloaded here: https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot.
https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware - MitigationModicon Controllers LMC058cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of ex * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Filter ports and IP through the embedded firewall. * Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP. * Disable all unused protocols (default configuration). * For more details refer to “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment User Guide”: https://www.se.com/ww/en/download/document/EIO0000004242/
https://www.se.com/ww/en/download/document/EIO0000004242/ - MitigationModicon Controllers M241cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of ex * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Filter ports and IP through the embedded firewall. * Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP. * Disable all unused protocols (default configuration). * For more details refer to “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment User Guide”: https://www.se.com/ww/en/download/document/EIO0000004242/
https://www.se.com/ww/en/download/document/EIO0000004242/ - MitigationModicon Controllers M251cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of ex * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Filter ports and IP through the embedded firewall. * Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP. * Disable all unused protocols (default configuration). * For more details refer to “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment User Guide”: https://www.se.com/ww/en/download/document/EIO0000004242/
https://www.se.com/ww/en/download/document/EIO0000004242/ - MitigationModicon Controllers M258cisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of ex * Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks. * Filter ports and IP through the embedded firewall. * Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP. * Disable all unused protocols (default configuration). * For more details refer to “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment User Guide”: https://www.se.com/ww/en/download/document/EIO0000004242/
https://www.se.com/ww/en/download/document/EIO0000004242/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 8.1–9.8
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (24)
Products and version ranges known to be affected.
- modicon_controllers_lmc058all versionsncsc_nlNLcpe:2.3:a:schneider_electric:modicon_controllers_lmc058:*:*:*:*:*:*:*:*
- modicon_controllers_m241all versionsncsc_nlNLcpe:2.3:a:schneider_electric:modicon_controllers_m241:*:*:*:*:*:*:*:*
advisories (2)
Vendor and ecosystem advisories describing this.
- NCSC-2024-0489Kwetsbaarheid verholpen in Schneider Electric ModiconNL2024-12-13csaf · ncsc_nlNL
Schneider Electric heeft een kwetsbaarheid verholpen in apparaten die het Modbus-protocol gebruiken.
- ICSA-24-352-04Schneider Electric Modicon2024-12-10icsa · cisa_csaf_otUS
Schneider Electric is aware of a vulnerability in its Modicon M241 / M251 / M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/ products. The Modicon M241/M251/M258/LMC058 products are Programmable Logic Controllers for performance-demanding applications. Failure to apply the Fix provided below may risk a denial of service and partial loss of Integrity of the controller, which could result in disruption operations. October 2025 Update: A remediation is now available for Modicon M258 / LMC058
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (3)
External citations — patches, advisories, analysis.
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-03.pdfcnnvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-03.pdfenisa_euvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-345-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-345-03.pdfnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan