Schneider Electric Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC Incorrect Calculation of Buffer Size (CVE-2024-11425)

high Tenable OT Security Plugin ID 502860

Synopsis

The remote OT asset is affected by a vulnerability.

Description

CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticated user is sending a crafted HTTPS packet to the webserver.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.

Solution

The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original can be found at CISA.gov.

Schneider Electric has identified the following remediations users can apply to reduce risk:

- Modicon M580 CPU (partnumbers BMEP* and BMEH*,excluding M580 CPU Safety): Version SV4.30 of Modicon M580 firmware includes a fix for this vulnerability and is available for download.
- Modicon M580 CPU Safety part numbers BMEP58-S and MEH58-S): Version SV4.21 of Modicon M580 firmware includes a fix for this vulnerability and is available for download.
- BMENOR2200H Versions prior to SV4.02.01: Version SV4.02.01 of BMENOR2200H firmware includes a fix for this vulnerability and is available here.
- EVLink Pro AC: Version V1.3.10 of EVLink Pro AC firmware includes a fix for this vulnerability and is available here.

Users should use appropriate patching methodologies when applying these patches to their systems. Schneider Electric strongly recommends making use of back-ups and evaluating the impact of these patches in a test and development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if assistance is needed for removing a patch.

If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

- Modicon M580 CPU (partnumbers BMEP* and BMEH*,excluding M580 CPU Safety): Set up network segmentation and implement a firewall to block all unauthorized access to Port 443/TCP. Configure the access control list following the recommendations of the user manuals: "Modicon M580, Hardware, Reference Manual".
- Modicon M580 CPU Safety part numbers BMEP58-S and MEH58-S): Set up network segmentation and implement a firewall to block all unauthorized access to Port 443/TCP. Configure the access control list following the recommendations of the user manuals: "Modicon M580, Hardware, Reference Manual".
- BMENOR2200H Versions prior to SV4.02.01: Set up network segmentation and implement a firewall to block all unauthorized access to Port 443/TCP.
- EVLink Pro AC: Follow the EVlink Pro AC cybersecurity guide.

Schneider Electric strongly recommends the following industry cybersecurity best practices.

- Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
- Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
- Place all controllers in locked cabinets and never leave them in the "Program" mode.
- Never connect programming software to any network other than the network intended for that device.
- Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
- Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
- Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
- When remote access is required, use secure methods, such as virtual private networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

For more information, see Schneider Electric security notification "SEVD-2025-014-01 Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC"

Plugin Details

Severity: High

ID: 502860

Version: 1.3

Type: remote

Family: Tenable.ot

Published: 2/18/2025

Updated: 4/23/2025

Supported Sensors: Tenable OT Security

Risk Information

VPR

Risk Factor: Low

Score: 3.6

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.7

Threat Score: 6.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:schneider-electric:modicon_m580_bmeh582040c_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh582040_firmware, cpe:/o:schneider-electric:modicon_m580_bmep582040h_firmware, cpe:/o:schneider-electric:modicon_m580_bmep586040c_firmware, cpe:/o:schneider-electric:modicon_m580_bmep582040s_firmware, cpe:/o:schneider-electric:modicon_m580_bmenor2200h_firmware, cpe:/o:schneider-electric:modicon_m580_bmep581020_firmware, cpe:/o:schneider-electric:modicon_m580_bmep586040_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh586040_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh584040c_firmware, cpe:/o:schneider-electric:modicon_m580_bmep586040s_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh584040s_firmware, cpe:/o:schneider-electric:modicon_m580_bmep583040_firmware, cpe:/o:schneider-electric:modicon_m580_bmep582020_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh582040s_firmware, cpe:/o:schneider-electric:modicon_m580_bmep581020h_firmware, cpe:/o:schneider-electric:modicon_m580_bmep584040s_firmware, cpe:/o:schneider-electric:modicon_m580_bmep584040_firmware, cpe:/o:schneider-electric:modicon_m580_bmep583020_firmware, cpe:/o:schneider-electric:modicon_m580_bmep582020h_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh584040_firmware, cpe:/o:schneider-electric:modicon_m580_bmep585040c_firmware, cpe:/o:schneider-electric:modicon_m580_bmep582040_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh586040s_firmware, cpe:/o:schneider-electric:modicon_m580_bmeh586040c_firmware, cpe:/o:schneider-electric:modicon_m580_bmep584020_firmware, cpe:/o:schneider-electric:modicon_m580_bmep585040_firmware

Required KB Items: Tenable.ot/Schneider

Exploit Ease: No known exploits are available

Patch Publication Date: 1/14/2025

Vulnerability Publication Date: 1/14/2025

Reference Information

CVE: CVE-2024-11425

CWE: 131

ICSA: 25-035-04

Detections

Analytics