CVE-2023-6408

State: Published
Severity: 8.1 High
Published: Feb 14, 2024
Updated: Aug 2, 2024
Reserved: Nov 30, 2023

Description

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of confidentiality, integrity of controllers when conducting a Man in the Middle attack.

Scores

CVSS	Score	Vector	Source
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	schneider

Weaknesses

CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Affected Products

Product	Versions
Modicon M340 CPU (part numbers BMXP34*)Schneider Electric	Versions prior to sv3.60Affected
Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety)Schneider Electric	Versions prior to sv4.20Affected
Modicon M580 CPU Safety (part numbers BMEP58S and BMEH58S)Schneider Electric	All VersionsAffected
EcoStruxure Control ExpertSchneider Electric	Versions prior to v16.0Affected
EcoStruxure Process ExpertSchneider Electric	Versions prior to v2023Affected

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-01.pdf

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.