A Crafted FTP Command Takes a Modicon M340 Off the Network
Four part numbers have fixed firmware. Two communication modules — including the M580 Global Data module — are listed as affected in all versions with remediation still pending.
CISA republished Schneider Electric SEVD-2025-224-05 on 17 September as ICSA-26-260-04. The vulnerability is CVE-2025-6625, an improper input validation weakness (CWE-20) scored 7.5 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. Crafted FTP commands render affected Modicon M340 controllers and communication modules unavailable.
Four products have fixes. The BMXNOE0100 is affected prior to 3.60, fixed in 3.60. The BMXNOE0110 is affected prior to 6.80, fixed in 6.80. The Modicon M340 controller is affected prior to SV3.70, fixed in SV3.70. The BMXNOR0200H is affected prior to SV1.7_IR27, fixed there.
Two are not fixed. The BMXNGD0100, the M580 Global Data module, and the BMXNOC0401 are listed as affected in all versions with remediation pending. For those, the only remedy is the mitigation list: disable FTP where it is not used, block TCP port 21 at the firewall, segment the network, use a VPN for remote access. Schneider notes that the FTP service is disabled by default.
Default-off is a weaker assurance than it sounds. FTP is still how a great many sites move recipes, configuration and firmware onto these controllers, and a service turned on during commissioning six years ago by a contractor who has since left is not a service anyone remembers enabling. The work here is proving the state of the service across a fleet rather than applying a patch.
The BMXNGD0100 being one of the unfixed modules is the awkward part, since Global Data is how M580 controllers exchange variables with each other. Sectors listed are chemical, commercial facilities, critical manufacturing, energy, and water and wastewater, worldwide.