Schneider Electric Modicon Controllers Uncontrolled Resource Consumption Vulnerability Leading to Denial-of-Service

A vulnerability allowing uncontrolled resource consumption has been identified in Schneider Electric's Modicon Controllers M241, M251, M258, LMC058, and M262, all versions prior to specific patched releases. This vulnerability could lead to a denial-of-service condition when an authenticated malicious user sends manipulated HTTPS Content-Length headers to the web server, causing it to consume resources improperly.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition, where the affected device becomes unresponsive or unavailable due to excessive resource consumption.

Remediation

Users can update to version 5.3.12.51 for Modicon Controllers M241 and M251, or version 5.3.9.18 for Modicon Controllers M262. The update can be downloaded from the respective product pages on the Schneider Electric website. For Modicon LMC058, no specific version is mentioned, but users should consult the Schneider Electric Software Installer for available updates.