Loading story…
CISA and Schneider Electric disclosed a critical vulnerability in the EcoStruxure OPC UA Server Expert and Modicon Communication Server products, which are widely deployed in commercial facilities, critical manufacturing, and energy sectors. The flaw, tracked as CVE-2024-10085, is an 'allocation of resources without limits or throttling' issue that allows remote attackers to cause a denial of service by sending a large number of OPC UA requests, potentially resulting in the loss of real-time process data from Modicon Controllers. The vulnerability has a CVSS v3.1 base score of 7.5 and a CVSS v4 base score of 8.2, indicating a high level of risk, and was reported by Jin Huang of ADLab of Venustech.
Schneider Electric has released a fix for the EcoStruxure OPC UA Server Expert in version SV2.01 SP3, which is available for download. For users unable to immediately apply the update, Schneider Electric recommends implementing specific mitigations to reduce the risk of exploitation. A permanent remediation plan is also being developed for all future versions of the Modicon Communication Server. CISA urges asset owners and operators in affected sectors to review the advisories and apply the recommended mitigations to protect against potential denial-of-service attacks targeting these critical industrial control systems.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Industrial Cyber reported that CISA had issued an ICS advisory concerning Schneider Electric vulnerabilities, reflecting public coverage of the advisory's release. The article does not clearly introduce a separate underlying real-world event beyond the advisory itself.
CISA released ICS advisory ICSA-25-301-01 covering vulnerabilities affecting Schneider Electric EcoStruxure. The advisory publicly documented the issue and associated security guidance for industrial control system defenders.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Schneider Electric published a set of security advisories covering multiple **EcoStruxure** and **Modicon** product lines, with impacts ranging from remote code execution to loss of confidentiality and integrity and security policy bypass. Affected products named across the notices include **EcoStruxure Foxboro DCS**, **EcoStruxure Automation Expert**, **EcoStruxure IT Data Center Expert**, **EcoStruxure Power Monitoring Expert**, **EcoStruxure Power Operation Advanced Reporting and Dashboards Module**, and several **Modicon PLC** families. National cyber agencies in Canada and France urged organizations to review Schneider Electric bulletins and apply vendor-provided mitigations and updates. One of the disclosed issues, tracked by CISA for **EcoStruxure Foxboro DCS**, is a **deserialization of untrusted data** flaw (`CWE-502`) affecting workstation and server components in versions prior to `CS8.1`; Schneider said Control Core Services and runtime components such as FCPs, FDCs, and FBMs are not affected. The vulnerability can enable loss of confidentiality and integrity and possible remote code execution if an administrator-authenticated user opens a malicious project file on a vulnerable workstation. The broader March advisory set references **`CVE-2025-11739`**, **`CVE-2025-13957`**, **`CVE-2026-1286`**, and **`CVE-2026-2273`**, and defenders are being told to prioritize patching alongside standard ICS protections such as network segmentation, firewalling, restricted access, and secured remote connectivity.
Jun 29, 2026
Schneider Electric, Siemens, Aveva, and Rockwell Automation released security advisories and patches for industrial control system and operational technology products. Schneider Electric fixed **CVE-2026-3869**, a CVSS 9.2 authentication vulnerability affecting Modicon M580 and M580 Safety controllers that could permit unauthorized access and complete compromise of affected systems. Siemens issued nine advisories, four covering critical vulnerabilities, and began deploying fixes for the Linux kernel Copy Fail flaw, **CVE-2026-31431**, which can provide root-shell access. Aveva remediated sensitive-data exposure and password-security issues in Pipeline Integrity Monitor, while Rockwell Automation published nine advisories affecting RSLinx Classic, industrial controllers, and FactoryTalk products; organizations should prioritize applying vendor patches to exposed OT assets.
Sep 11, 2026
Schneider Electric disclosed multiple vulnerabilities in its industrial-control portfolio, affecting **EcoStruxure IT Data Center Expert** version 9.1.2 and earlier and **PowerLogic T300** version 2.9.8-5620 and earlier. The PowerLogic T300 flaw stems from improper neutralization of special elements in an operating-system command, creating an OS command-injection risk. The Canadian Centre for Cyber Security issued advisory **AV26-912** and urged administrators to review Schneider Electric security notifications, implement vendor-recommended mitigations, and apply required updates. Organizations operating affected products should identify exposed deployments and prioritize remediation, particularly for systems connected to operational-technology or data-center environments.
Sep 11, 2026