CVE-2024-8935: Schneider Electric Modicon m340 BMXP341000

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers when conducting a Man-In-The-Middle attack between the controller and the engineering workstation while a valid user is establishing a communication session. This vulnerability is inherent to Diffie Hellman algorithm which does not protect against Man-In-The-Middle attacks.

Affected products

• Schneider Electric Modicon m340 BMXP341000
• Schneider Electric Modicon MC80 BMKC8020301: any version
• Schneider Electric Modicon Momentum Unity m1e Processor: any version
• Schneider Electric Modicon m340 CPU Part Numbers BMXP34*
• Schneider Electric Modicon MC80 Part Numbers BMKC80: any version
• Schneider Electric Modicon Momentum Unity m1e Processor 171cbu*: any version

Published 2024-11-13. Last modified 2026-06-17.