A CSRF vulnerability across various Schneider Electric Modicon industrial controllers allows unauthorized actions, posing a significant risk to operational technology (OT) integrity.

This is a Cross-Site Request Forgery (CWE-352) vulnerability present in the web server component of the affected controllers. An attacker can trick an authenticated user into performing unintended actions on the device’s web interface, potentially leading to unauthorized configuration changes or data exposure.

With a CVSS score of 8.8, this vulnerability poses a severe risk to industrial environments. Unauthorized manipulation of PLC settings or data leakage could lead to operational disruptions, safety risks, or the compromise of sensitive industrial process information.

Immediate Action: Review the Schneider Electric security advisory (SEVD-2022-011-01) to identify specific firmware updates or configuration hardening steps required for your specific hardware modules.

Proactive Monitoring: Monitor web server access logs for anomalous requests or unauthorized session activity originating from within the internal network.

Compensating Controls: Restrict access to the management web interfaces of industrial controllers to isolated management networks and implement strict firewall rules to prevent cross-site interactions.

Public Exploit Available: Unknown.

Operators of Schneider Electric industrial equipment must assess the exposure of their web interfaces immediately. Apply the recommended vendor patches or implement strict network segmentation to ensure that unauthorized actors cannot reach these management interfaces.