CVE-2013-0663: Schneider Electric Modicon m340

Medium severity, CVSS 6.8. EPSS: 6% chance of exploitation in the next 30 days.

Cross-site request forgery (CSRF) vulnerability on the Schneider Electric Quantum 140NOE77111, 140NOE77101, and 140NWM10000; M340 BMXNOC0401, BMXNOE0100x, and BMXNOE011xx; and Premium TSXETY4103, TSXETY5103, and TSXWMY100 PLC modules allows remote attackers to hijack the authentication of arbitrary users for requests that execute commands, as demonstrated by modifying HTTP credentials.

Affected products

• Schneider Electric Modicon m340: version bmxnoc0401 only; version bmxnoe011xx only; version bmxnoe0100x only
• Schneider Electric Modicon Premium: version tsxety4103 only; version tsxety5103 only; version tsxwmy100 only
• Schneider Electric Modicon Quantum PLC: version 140noe77101 only; version 140noe77111 only; version 140nwm10000 only

Published 2013-04-04. Last modified 2026-06-16.