The short version
On 17 September 2026, CISA published ICSA-26-260-04 for the Schneider Electric Modicon M340 controller and its Ethernet communication modules. It covers one CVE, CVE-2025-6625. A specially crafted FTP command sent to the device causes a denial of service. The controller, or the module, stops.
The score is 7.5, and the vector is the part to read: AV:N/AC:L/PR:N/UI:N. Reachable over the network, no login, no user involved. Anyone who can send a packet to port 21 on the device can do it.
The M340 is the controller in a lot of small water plants, pump stations and packaging lines. CISA lists Water and Wastewater, Energy, Chemical and Critical Manufacturing, deployed worldwide.
What the advisory says
- Product: Modicon M340 controller and five Ethernet modules.
- The flaw: improper input validation (CWE-20) in the FTP service. One crafted command, and the device stops responding.
- Fixed versions: SV3.70 for the M340 CPU. 3.60 for the BMXNOE0100 Modbus/TCP module. 6.80 for the BMXNOE0110 FactoryCast module. SV1.7 IR27 for the BMXNOR0200H Ethernet and serial RTU module. Each one needs a reboot.
- No fix yet: all versions of the BMXNGD0100 M580 Global Data module and the BMXNOC0401 X80 Ethernet module. Schneider says it is establishing a remediation plan and will update the advisory when one is available.
- Schneider's mitigations: FTP is disabled by default, so keep it disabled when not in use. Segment the network and firewall port 21. Use a VPN if remote access is required.
| Part | Role | Fixed version |
|---|---|---|
| Modicon M340 CPU | The controller | SV3.70 |
| BMXNOE0100 | Modbus/TCP Ethernet | 3.60 |
| BMXNOE0110 | FactoryCast Ethernet | 6.80 |
| BMXNOR0200H | Ethernet and serial RTU, IEC 60870-5-104 and DNP3 | SV1.7 IR27 |
| BMXNGD0100 | M580 Global Data | None yet |
| BMXNOC0401 | X80 Ethernet, EtherNet/IP and Modbus/TCP | None yet |
Why this one matters for a water plant
Two reasons.
The first is the BMXNOR0200H. That is the RTU module utilities use to report a remote site back to the control room over IEC 60870-5-104 or DNP3. It sits at the lift station, the well head, the reservoir, usually on a cellular link, usually with nobody there. A module that can be stopped from the network is a remote site that goes dark until someone drives out.
The second is the pair with no fix. If you have a BMXNGD0100 or a BMXNOC0401 on the rack, there is nothing to install. The only thing between that module and a crafted packet is whether the packet can reach it.
This is a reachability problem
Read Schneider's three mitigations again. Turn FTP off. Block port 21. Use a VPN. All three are the same instruction: stop the packet from arriving.
That is the right instruction, and it is worth being precise about it, because "use a VPN" is where most sites stop. A VPN lets a device onto the network. Once it is on, it can reach port 21 on every module on the segment. The integrator's laptop, the on-call engineer's home PC, the vendor's jump host: each one is a source for this packet, and each one is also the kind of machine that gets compromised.
The control that fits an unauthenticated network flaw is narrower than a VPN. Decide, per controller, which sources are allowed to talk to it and on which protocol. The HMI talks Modbus to the pump controller. The control room polls the RTU module on DNP3. Nothing else talks to either, and nothing talks FTP to anything unless a named person opened a session for it, for an hour, and it was recorded.
That rule does not need a firmware update. It goes in beside the existing network, one controller at a time, and it covers the two modules that have no fix as well as the four that do.
On FTP being "disabled by default"
It is, on a new module. It is also the service integrators turn on to load firmware and web pages during commissioning, and there is no reason for them to turn it off again once the job is done. So the default tells you nothing about your plant. The configuration of each module does.
Check it. If FTP is on and nobody can say why, turn it off. If someone needs it, that is a maintenance task with a start and an end, not a standing setting.
What to do this week
- List every M340 and every Ethernet module on your racks. Part number and firmware version. The advisory works by part number; the product family is not enough.
- Check FTP on each module. Off unless there is a current reason for it to be on.
- Write down who can reach each controller. Every workstation, every remote path, every vendor. Then cut the list to the sources that do the job.
- Schedule the firmware. SV3.70, 3.60, 6.80 and SV1.7 IR27, each with a reboot, on your normal validated window.
- For BMXNGD0100 and BMXNOC0401, there is no step four. Steps two and three are the whole answer until Schneider publishes a fix. Note the advisory number and check it again next month.