CVE-2024-5056 Overview
CVE-2024-5056 affects Schneider Electric Modicon M340 controllers and BMXNOE0100/BMXNOE0110 Ethernet network modules. The vulnerability is classified as [CWE-552] Files or Directories Accessible to External Parties. A remote attacker with network access can interact with exposed files or directories on the device filesystem. Removing specific files or directories prevents firmware updates and disrupts normal webserver operation on the affected industrial control equipment.
Critical Impact
Remote unauthenticated attackers can disrupt firmware update functionality and impair the embedded webserver by deleting specific files or directories on Modicon M340 and BMXNOE0100/0110 modules.
Affected Products
- Schneider Electric Modicon M340 (firmware and hardware)
- Schneider Electric BMXNOE0100 Ethernet network module (firmware and hardware)
- Schneider Electric BMXNOE0110 Ethernet network module (firmware and hardware)
Discovery Timeline
- 2024-06-12 - CVE-2024-5056 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5056
Vulnerability Analysis
The vulnerability stems from improper access control over files and directories exposed by the Modicon M340 and BMXNOE0100/0110 modules. An attacker reaching the device over the network can access filesystem resources that should not be externally reachable. Deleting or altering specific files or directories breaks the firmware update workflow and destabilizes the embedded webserver. This affects operator visibility and the ability to service the device, both of which are important in operational technology (OT) environments.
Root Cause
The root cause is a design weakness cataloged as [CWE-552]: sensitive files and directories on the device filesystem are accessible to external parties without adequate authorization checks. The affected components do not sufficiently restrict which filesystem paths remote clients can enumerate or modify through the exposed network services.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with reachability to the controller's or module's exposed services can trigger the condition remotely. Because Modicon M340 controllers and BMXNOE0100/0110 modules are commonly deployed in industrial and infrastructure networks, exposure typically depends on network segmentation, jump-host isolation, and whether the device is reachable from engineering or corporate segments.
No verified public proof-of-concept code is available for this vulnerability. See the Schneider Electric Security Notice SEVD-2024-163-01 for vendor-supplied technical details.
Detection Methods for CVE-2024-5056
Indicators of Compromise
- Failed or aborted firmware update attempts on Modicon M340, BMXNOE0100, or BMXNOE0110 devices without a corresponding operational cause.
- Unexpected HTTP errors, missing pages, or degraded responses from the embedded webserver on affected controllers and modules.
- Unusual filesystem-related network requests originating from hosts outside of engineering workstations or asset management systems.
Detection Strategies
- Monitor HTTP and management protocol traffic to Modicon M340 and BMXNOE01x0 modules for path enumeration or file access requests from unexpected sources.
- Baseline normal firmware update and webserver traffic patterns, then alert on deviations such as unauthorized file deletion attempts.
- Correlate ICS asset inventory with network flow logs to identify unauthorized clients communicating with affected devices.
Monitoring Recommendations
- Ingest syslog and network telemetry from OT network taps and industrial firewalls into a centralized analytics platform for continuous review.
- Track firmware version, webserver availability, and update success/failure state per device to detect impaired behavior early.
- Alert on any changes to authorized engineering workstation allow-lists interacting with Modicon controllers and Ethernet modules.
How to Mitigate CVE-2024-5056
Immediate Actions Required
- Review the Schneider Electric Security Notice SEVD-2024-163-01 and apply the vendor-recommended remediation for each affected product line.
- Inventory all Modicon M340, BMXNOE0100, and BMXNOE0110 devices and confirm firmware versions against the advisory.
- Restrict network reachability to affected devices from anything other than authorized engineering workstations and asset management systems.
Patch Information
Refer to Schneider Electric's advisory SEVD-2024-163-01 for fixed firmware versions and remediation guidance per affected product. Follow standard OT change management procedures and validate firmware updates in a staging environment before broad deployment.
Workarounds
- Segment affected controllers and modules onto isolated OT networks protected by industrial firewalls with strict allow-lists.
- Disable unused network services on the affected devices where operationally feasible, following vendor guidance.
- Enforce least-privilege access on jump hosts and engineering workstations that communicate with Modicon controllers and Ethernet modules.
- Monitor and log all management and file access traffic to affected devices to detect abuse attempts.
# Example: restrict access to Modicon M340 management interface using iptables on an upstream gateway
# Replace 10.10.20.0/24 with your authorized engineering subnet
# Replace 10.10.50.15 with the device IP
iptables -A FORWARD -s 10.10.20.0/24 -d 10.10.50.15 -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -d 10.10.50.15 -p tcp --dport 80 -j DROP
iptables -A FORWARD -d 10.10.50.15 -p tcp --dport 502 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
