CVE-2023-6408 is a high severity improper message integrity flaw in Schneider Electric Modicon M340 controllers. A man in the middle attacker may cause a denial of service and compromise confidentiality and integrity of the controller. Fixed firmware versions are in Schneider notice SEVD-2024-044-01.
What's affected
- Product: Schneider Electric Modicon M340 controllers, including BMXP341000 and BMXP341000H firmware, per the record.
- Affected versions: the record lists firmware with no range. The vendor notice SEVD-2024-044-01 has the table.
- Fixed version: see the vendor notice. This post does not state one.
- Attack position: network, with a man in the middle, and high attack complexity.
The record gives a CVSS 3.1 base score of 8.1 (high) with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
Identify the controller model and firmware in your asset register or through the vendor engineering tool, then compare with the table in SEVD-2024-044-01.
The flaw needs an attacker positioned between the controller and its peer, so also map which networks carry traffic to these controllers. Controllers reachable from office or remote access networks deserve attention first.
What to do now
- List every Modicon M340 in service with model and firmware version.
- Open Schneider Electric notice SEVD-2024-044-01 and note remediation or mitigations for each model.
- Apply the vendor firmware or mitigations in a maintenance window, following your change process.
- Put controller traffic on segmented networks with no path from general user networks.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-924 (Improper Enforcement of Message Integrity During Transmission): Messages sent over a channel can be altered in transit without the receiver noticing.
CWE-924 covers channels where messages can be changed in transit without the receiver noticing. If an attacker can sit in the path, they can alter or inject traffic and the controller has no reliable way to tell.
The base score is high because the impact covers all three security properties, even though the attack needs a network position and is complex to carry out. Industrial networks often depend on isolation instead of protocol protection, so the useful defence is keeping the path between engineering tools and controllers short and controlled.
Quick check
Does this need local access?
The vector shows network access, but the attacker must sit in the path between the two ends, which is why attack complexity is high.
Which firmware is fixed?
Use the table in Schneider notice SEVD-2024-044-01. The NVD record does not list one.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
