In brief · As of October 2026
A Schneider plant consists of Modicon M580 or M340 with X80 modules in the rack, M241/M251/M262 with TM3 expansions on the local bus, Altivar and Lexium drives, Harmony HMIs and Ethernet modules. From the maintenance PC, CPU, Ethernet modules (BMENOC) and drives answer via Modbus FC43, EtherNet/IP Identity Object or OPC UA; the modules in the rack and on the local bus are seen only by the controller. They get into the device list via the CPU's web diagnostics or online from Control Expert or Machine Expert, with reference (BMEP58xxxx) and firmware. Matching additionally needs the Control Expert version, because Schneider often ties the fix to it. Schneider publishes as CSAF in its own provider: 291 documents, 30 new in 2026, without ROLIE feed, behind a bot block, without CPE. SBOMs exist for every product, but only under NDA; for the plant you do not need one.
What hangs on a Modicon controller and what of it is visible on the network
With M580 and M340, CPU, Ethernet modules and X80 I/O modules sit in a rack with an Ethernet or X-Bus backplane; with M241, M251 and M262, TM3 expansion modules hang on the controller's local bus. Added to this are Altivar drives and Lexium servos via Modbus TCP or EtherNet/IP, Harmony panels and ConneXium switches.
- Visible via IP from the maintenance PC: CPU and BMENOC modules via Modbus FC43 ‘Read Device Identification’ (product code, firmware), M241/M262 and EIP adapters via the EtherNet/IP Identity Object, M262/M580 via OPC UA, drives via Modbus or CIP, switches via SNMP.
- Only via the controller: X80 modules in the M580/M340 rack and TM3 modules on the local bus. Their reference and firmware are shown by the CPU's web diagnostics and the online mode of Control Expert or Machine Expert.
- Only from the engineering: the Control Expert or Machine Expert version that decides on the fix, and the assignment to the sub-plant.
How rack and expansion modules get into the list: CPU diagnostics, Control Expert, Modbus FC43
The embedded web server of the M580 CPU shows the rack configuration with reference and firmware per module; the same tree is available online in Control Expert. For M241/M262, Machine Expert provides the TM3 list. Reachable from the network remain the devices with their own address:
- EcoStruxure Control Expert (M580, M340) or Machine Expert (M241, M251, M262): hardware configuration with reference per module (BMEP58xxxx), plus the Control Expert version, which the advisories name as the corrected version.
- Modbus FC43 "Read Device Identification": M580 and BMENOC modules return manufacturer name, product code and firmware revision on request via TCP 502 – documented in Schneider FAQ FA406524. Without discovery, per IP address.
- EtherNet/IP Identity Object on M241/M262 and EIP adapters, OPC UA on M262/M580, SNMP on Ethernet modules. Which method works where is explained in the article on the network scan.
How Schneider Electric publishes advisories and what matching runs on
At Schneider Electric the PSIRT is called CPCERT. Advisories appear on the Security Notifications page as PDF and as CSAF JSON. The provider (provider-metadata.json) is registered as a trusted provider in the BSI's CSAF lister, but as a directory distribution without ROLIE feed and with mirror_on_CSAF_aggregators: false. Practical consequence: index.txt and changes.csv returned HTTP 403 (Akamai "Access Denied") when we retrieved them with curl; the files were only reachable through a different retrieval route. Anyone wanting to monitor the feed automatically has to plan for that.
| Measurement (7 Oct 2026) | Result |
|---|
| CSAF documents in total | 291 |
| of which new in 2026 | 30 |
| Published or updated in 2026 | 45 (30 new + 15 re-releases) |
| New documents 2023 / 2024 / 2025 | 40 / 35 / 42 |
| Last change | 8 Sep 2026 (monthly bursts) |
| ROLIE feed | none – directory only |
In 2026 the affected products included Modicon M580 (SEVD-2026-251-04), Modicon M340 and Altivar Process; several older Modicon advisories were re-released in a new version on 8 Sep 2026.
In the three documents from 2026 we examined, neither CPE nor PURL appears. The M580 advisory SEVD-2026-251-04 contains no product_identification_helper at all: the product tree names "Modicon M580" and "Modicon M580 Safety" with firmware branches, and the fix is described as "EcoStruxure Control Expert V15.2 or later". The Easergy MiCOM document uses model_numbers, the EcoStruxure IT document only names with versions.
For the device list this means: product family, firmware version and engineering version have to be maintained together. A row "Modicon M580, FW 4.20" without the Control Expert version cannot be conclusively assessed against the September advisory.
Schneider has created SBOMs for every product since 2021 but hands them out only under NDA through a portal; for the plant you do not need one.
What this means for installations with Schneider components
- Carry Modicon type, firmware and Control Expert/Machine Expert version per controller; the latter decides on the fix.
- Drives (Altivar, Lexium) and HMIs (Harmony/Magelis) are advisory targets of their own – with their own firmware in the list.
Three attributes per controller, three network methods depending on the series, a rack only the CPU knows, and a feed that blocks automated retrieval. In Werkspilot Scan, Schneider is stage 2: the run from the maintenance PC covers CPU, Ethernet modules and drives via Modbus FC43, ListIdentity and OPC UA and keeps reference and firmware per device; the rack list is added from the CPU diagnostics. We are currently trialling this stage with development partners on their plants.
All 13 manufacturers compared: SBOM by manufacturer →
Trial Werkspilot Scan on your own plant.
We are trialling the capture with a few plant builders on their test or reference plants, for four months, extended stage by stage around their controllers. The partner gets one plant of their choice as a plant SBOM: every reachable device with manufacturer, order number and firmware version, open items listed individually.
Ask about the development partnership →
Werkspilot keeps these devices per plant and reports when an advisory hits one of them. The figures in this article are our own measurements from 7 Oct 2026; manufacturers change feeds and pages without notice.
