Vulnerabilities
Schneider Electric Modicon M340 Controllers Vulnerable to FTP‑Triggered DoS (CVE‑2025‑6625)
A new flaw in Schneider Electric’s Modicon M340 controllers and several communication modules allows attackers to trigger a denial‑of‑service by sending a specially crafted FTP command. The improper input validation (CWE‑20) can render the device unusable, affecting critical infrastructure sectors worldwide. The vulnerability, rated CVSS 7.5, impacts a range of firmware versions and modules, and requires immediate patching to prevent operational disruptions.
Schneider Electric has disclosed a critical flaw—CVE‑2025‑6625—in its Modicon M340 industrial control family. The issue stems from improper input validation in the device’s FTP handling code. When an attacker sends a crafted FTP command, the controller can be forced into a crash or hung state, effectively denying service to any processes that rely on that device.
What’s at risk?
- Modicon M340 Controllers with firmware versions prior to SV3.70
- Ethernet/Serial RTU Modules (generic/
- M580 Global Data Modules (all releases)
- Modbus/TCP Ethernet Modules (versions <3.60)
- FactoryCast Ethernet Modules (versions <6.80)
The flaw is not a remote code execution vector; it simply stops the device from functioning, which can cripple processes in chemical plants, manufacturing lines, energy grids, and water treatment facilities.
Impact
With a CVSS score of 7.5, the vulnerability can lead to significant downtime for critical infrastructure. Attackers could exploit it from any network that can reach the device’s FTP interface—often a remote management network or an exposed edge gateway.
Mitigation
Schneider Electric recommends all operators immediately update affected firmware to the latest release (SV3.70 or newer) and apply the vendor’s patch for the specific module model. Disabling the FTP service where it is not required also reduces exposure.
Operators should verify that the patch has been applied by checking the firmware version on each unit and ensure that any legacy devices are either upgraded or isolated from the network.
Takeaway
Industrial control systems can be surprisingly vulnerable to simple input‑validation bugs. This DoS flaw underscores the importance of keeping firmware current and disabling unused services on critical devices.
Related vulnerabilities
Hitachi Energy REB500: CVE‑2024‑8176 & CVE‑2025‑59375 Enable DoS via IEC61850
Hitachi Energy REB500 versions ≤8.3.3.1 suffer two libexpat flaws (CVE‑2024‑8176 and CVE‑2025‑59375) that can be leveraged by authenticated users to trigger a denial‑of‑service. The vendor has released a patch to 8.3.4.0; operators should update immediately and monitor IEC61850 traffic.
Read briefing
CVE‑2025‑50165: Critical Windows Imaging Component RCE via Crafted JPEG
Microsoft’s WindowsCodecs.dll contains CVE‑2025‑50165, a critical flaw that can trigger remote code execution when a specially crafted JPEG is processed. The vulnerability is in the jpeg_finish_compress routine, and while Microsoft rates it critical, exploitability is considered low. Defenders should apply the latest Windows updates, disable unnecessary image processing on servers, and monitor for anomalous JPEG handling.
Read briefing
TrendAI Apex One Local Privilege Escalation via Incomplete Cleanup (CVE-2025-71414)
A local privilege escalation flaw in TrendAI Apex One Security Agent allows attackers who can run low‑privileged code to gain SYSTEM rights by exploiting improper cleanup in the TmccCore component. The CVE‑2025‑71414 vulnerability has a CVSS score of 7.8. Defenders should patch immediately and monitor for suspicious process termination events.
Read briefing
CVE-2025-48927: TeleMessage SGNL Heapdump Leak Vulnerability Remediated, No Exploitation Detected
TeleMessageTM SGNL, an enterprise messaging platform, suffered a CVE-2025-48927 flaw that exposed a public /heapdump endpoint, potentially leaking 150 MB of heap memory containing plaintext credentials. The issue was fully remediated in early May 2025, with independent verification and no customer action required. Defenders should confirm their deployments are patched, disable actuator endpoints, and monitor GreyNoise feeds for related reconnaissance activity.
Read briefing