Paper/Archive/CVE-2026-3869

CVE-2026-3869

Schneider Electric Modicon M580 — CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity a…

EPSS 0.5%CVSS 9.2

critical.is priorityof 100

CVSS 9.2 (CNA)9.2 / 10 × 3027.6 Not in CISA KEV+300.0 EPSS percentile 45.6.456 × 209.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

CWE-303 : Incorrect Implementation of Authentication Algorithm vulnerability exists that could cause loss of confidentiality, integrity and availability of the PLC provided an application project with a lower application level is running on the PLC.

Affected

ProductAffectedFixed inSource

Modicon M580All versions with an application level below 4.00–CNA

Modicon M580 SafetyAll versions with an application level below 4.20–CNA

Scores by source

schneider (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdownload.se.com/files?p_Doc_Ref=SEVD-2026-251-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-251-04.pdf