Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Data Center Expert product.
The Data Center Expert product provides an efficient way for organizations to monitor and manage their company-wide multi-vendor physical infrastructure, including power, cooling, security and environmental.
Failure to apply the remediations provided below may risk unauthorized access to a DCE instance, which could result in downtime or outage.

Overview

Summary: Data Center Expert - SEVD-2022-165-04 CSAF Version

Summary: Data Center Expert - SEVD-2022-165-04 PDF Version

Data Center Expert

Summary: Original Release

Summary: Affected versions updated to include V7.9.0, remediation guidance updated for clarity.

Schneider Electric

Data Center Expert

Schneider Electric Data Center Expert version 7.9.0 and prior

Schneider Electric Data Center Expert 7.9.1

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party.

CVE Description

Data Center Expert V7.9.1 and newer includes fixes for these vulnerabilities. You can download the latest version on the EcoStruxure IT Entitlements Portal. If you do not have an EcoStruxure IT Entitlements account, please contact Customer Care Center.
 https://www.se.com/us/en/work/support/contacts.jsp
 Release Notes:
 https://dcimsupport.ecostruxureit.com/hc/en-us/articles/4517646198941-Data-Center-Expert-7-9-1-release-notes

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Leverage secure protocols wherever available (HTTPS)
• Leverage certificates signed by an external and trusted CA
Follow security hardening guidelines found in https://dcimsupport.ecostruxureit.com/hc/en-us/articles/360039289633-Data-Center-Expert-Security-Handbook.

CVE-2022-32518

A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a malicious third-party.

CVE Description

CVE-2022-32519

CVE Description

CVE-2022-32520

A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data is posted to the web server.

CVE Description

CVE-2022-32521


EcoStruxure Power Commission

Summary: Original Release

Summary: EcoStruxure Power Commission - SEVD-2022-165-05 CSAF Version

Summary: EcoStruxure Power Commission - SEVD-2022-165-05 PDF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Power Commission software.
The EcoStruxure Power Commission software is comprehensive software to provide strong function for setup, test and commission for low voltage power distribution switchboard.
Failure to apply the remediations provided below may risk remote code execution and Information Disclosure, which could result in loss of data integrity and confidentiality.

Overview

Schneider Electric

EcoStruxure Power Commission

Schneider Electric EcoStruxure Power Commission <V2.22

Schneider Electric EcoStruxure Power Commission >=V2.22

CVE-2022-0223

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution.

CVE Description

V2.22 and later of EcoStruxure Power Commission includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/62980-ecostruxure-power-commission/#software-and-firmware

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Configure firewall to restrict network access to authorized IP addresses as applicable.
• Use low privileged user account for running EPC. Do not run EPC with administrator privilege.
• Keep Operating System and Chrome browser up to date.
• Recommend not to use any web browser while using EPC.
• Do not open unknown or malicious websites in browser while using EPC.
• Do not click on unknown links or open attachments from unknown source.
• Train the users - Provide cybersecurity training to all your employees to help keep your organization secure. Explain phishing emails, infected attachments, malicious websites, and other methods that attack them directly.

CVE-2022-22731

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause path traversal attacks

CVE Description

CVE-2022-22732

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server when an attacker sends a fetch request from third-party site or malicious site.

CVE Description


Summary: Original Release

Summary: Schneider Electric C-Bus Home Automation Products - SEVD-2022-165-06 CSAF Version

Summary: Schneider Electric C-Bus Home Automation Products - SEVD-2022-165-06 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Schneider Electric C-Bus Home Automation products listed below.
The Schneider Electric C-Bus Home Automation products are fully integrated systems that can control and automate lighting and many other electrical systems and products.
Failure to apply the remediations provided below may risk unauthorized access, which could allow an unauthorized individual to control the device.

Overview

Schneider Electric

Schneider Electric Clipsal C-Bus Network Automation Controller <=V1.10.0

Schneider Electric Clipsal C-Bus Network Automation Controller V1.11.0

Schneider Electric Clipsal Wiser for C-Bus Automation Controller <=V1.10.0

Clipsal Wiser for C-Bus Automation Controller, 5500SHAC

Schneider Electric Clipsal Wiser for C-Bus Automation Controller,V1.11.0

Schneider Electric Schneider Electric C-Bus Network Automation Controller <=V1.10.0

Schneider Electric Schneider Electric C-Bus Network Automation Controller V1.11.0

Schneider Electric Schneider Electric Wiser for C-Bus Automation Controller <=V1.10.0

Schneider Electric Schneider Electric Wiser for C-Bus Automation Controller V1.11.0

SpaceLogic C-Bus Application Controller

Schneider Electric SpaceLogic C-Bus Application Controller <=V1.10.0

SpaceLogic C-Bus Application Controller,

Schneider Electric SpaceLogic C-Bus Application Controller V1.11.0

Schneider Electric SpaceLogic C-Bus Network Automation Controller <=V1.10.0

Schneider Electric SpaceLogic C-Bus Network Automation Controller, 5500NAC2 V1.11.0

CVE-2022-32513

A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password.

CVE Description

Version 1.11.0 of Schneider Electric C-Bus Network Automation Controller includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/LSS5500NAC/spacelogic-cbus-network-automation-controller-bacnet-modbus-ip-6m-din-mount-24v-dc/
A reboot is required.
After logging into the device, go to the configurator page and the firmware version is displayed in the lower left corner.

Version 1.11.0 of Schneider Electric Wiser for C-Bus Automation Controller includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/LSS5500SHAC/spacelogic-cbus-automation-controller-rs232-485-ethernet-din-mount-24v-dc/
A reboot is required.
After logging into the device, go to the configurator page and the firmware version is displayed in the lower left corner.

Version 1.11.0 of Clipsal C-Bus Network Automation Controller includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/5500NAC/cbus-network-automation-controller-bacnet-modbus-ip-6m-din-mount-24v-dc/
A reboot is required.
After logging into the device, go to the configurator page and the firmware version is displayed in the lower left corner.

Version 1.11.0 of Clipsal Wiser for C-Bus Automation Controller includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/5500SHAC/wiser-for-cbus-automation-controller-rs232-485-ethernet-din-mount-24v-dc/
A reboot is required.
After logging into the device, go to the configurator page and the firmware version is displayed in the lower left corner.

Version 1.11.0 of SpaceLogic C-Bus Network Automation Controller includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/5500NAC2/network-automation-controller-spacelogic-cbus-bacnet-modbus-ip-6m-din-mount-24v-dc/
A reboot is required.
After logging into the device, go to the configurator page and the firmware version is displayed in the lower left corner.

Version 1.11.0 of SpaceLogic C-Bus Application Controller includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/5500AC2/application-controller-spacelogic-cbus-rs232-485-ethernet-din-mount-24v-dc/
A reboot is required.
After logging into the device, go to the configurator page and the firmware version is displayed in the lower left corner.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• These controller products should not have a publicly accessible IP address.
• Do NOT use port forwarding to access these products from the public internet.
• These products should be on their own network segment. If your router supports a guest network or VLAN, it is preferable to locate the controller there.
• Use the strongest Wi-Fi encryption available.
• Use HTTPs in local network.
• Only visit trusted websites.

CVE-2022-32514

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page.

CVE Description


CanBRASS

Summary: Original Release

Summary: CanBRASS - SEVD-2022-165-07 CSAF Version

Summary: CanBRASS - SEVD-2022-165-07 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its CanBRASS product.
The CanBRASS product (https://www.se.com/ww/en/product-range/61293-canbrass/#software-and-firmware) is a design and costing tool for Canalis busbar trunking runs.
Failure to apply the remediation provided below may risk remote code execution which could result in unauthorized execution of code.

Overview

CVE-2022-32512

A CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code execution when a command which exploits this vulnerability is utilized.

CVE Description

Version 7.6 of CanBRASS includes a fix for this vulnerability and is available for download.
A reboot of the system is needed after installation.


EcoStruxure™ Cybersecurity Admin Expert

Summary: Original Release

Summary: EcoStruxure™ Cybersecurity Admin Expert - SEVD-2022-165-08 CSAF Version

Summary: EcoStruxure™ Cybersecurity Admin Expert - SEVD-2022-165-08 PDF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Cybersecurity Admin Expert product.
The EcoStruxure™ Cybersecurity Admin Expert product (CAE) is a solution for managing cybersecurity in an electrical network’s operational technology (OT).
Failure to apply the remediation provided below may risk man-in-the-middle and/or device spoofing attacks, which could result in the total compromise of devices configured by the CAE.

Overview

Schneider Electric EcoStruxure™ Cybersecurity Admin Expert (CAE) <=2.2

Schneider Electric EcoStruxure™ Cybersecurity Admin Expert (CAE) 2.4

CVE-2022-32747

A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account creation by spoofing a device on the local network.

CVE Description

Version 2.4 of the EcoStruxure™ Cybersecurity Admin Expert product includes fixes for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/63515-ecostruxure-cybersecurity-admin-expert/#software-and-firmware
Install the new CAE version 2.4 (over any previous version) and the fixes will be available.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
In normal operation, the CAE software tool is connected to devices for a very limited time and is offline most of the time. However, it is recommended that end-users of the Cybersecurity Admin Expert tool do the following:
• Refresh the device’s status before sending configuration to ensure the validity of the devices certificate.
• Use proper network segmentation and closely monitor traffic for signs of malicious activity when connected to devices
• Check the status of the devices on the network

CVE-2022-32748

A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure devices. Additionally, credentials could leak which would enable an attacker the ability to log into the configuration tool and compromise other devices in the network

CVE Description


Summary: Original Release

Summary: A fix is available for the OPC UA Modicon Communication Module (BMENUA0100) that addresses the multiple vulnerabilities reported.

Summary: There are remediations available for the OPC UA Modicon Communication Module (BMENUA0100) (page 3) and X80 advanced RTU Communication Module (BMENOR2200)

Summary: OPC UA and X80 advanced RTU Modicon Communication Modules - SEVD-2022-193-01_v3 CSAF Version

Summary: OPC UA and X80 advanced RTU Modicon Communication Modules - SEVD-2022-193-01_v3 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its BMENUA0100 - OPC UA module and BMENOR2200H X80 advanced RTU communication module for M580.
The BMENUA0100 - OPC UA module for M580 is an Ethernet communications module with an embedded OPC UA server for communication with OPC UA clients, including SCADA.
The BMENOR2200H – X80 advanced RTU module is an Ethernet communication module that enables M580 platform to use RTU protocol exchange with RTU stations.
Failure to apply the mitigations provided below may introduce risks including denial of service of the webserver and bypass of the secure boot process, which could result in running an unauthorized firmware.

Overview

Schneider Electric OPC UA Modicon Communication Module (BMENUA0100) version 1.10 and prior

Schneider Electric X80 advanced RTU Communication Module (BMENOR2200H) 1.0

Schneider Electric X80 advanced RTU Communication Module (BMENOR2200H) 2.01

Schneider Electric X80 advanced RTU Communication Module (BMENOR2200H) 3.02.02

Schneider Electric OPC UA Modicon Communication Module (BMENUA0100) 2.01

CVE-2022-34759

A CWE-787: Out-of-bounds Write vulnerability exists that could cause a denial of service of the webserver due to improper parsing of the HTTP Headers.

CVE Description

BMENUA0100 V2.01 includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMENUA0100_FIRMWARE_SV_02.01/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure BMENUA0100 module to operate in Secured mode. Refer to the user manual below in the section ‘Cybersecurity Operating Modes’ and change the default passwords.
• Configure role-based access control and local authentication for users of BMENUA0100 module. Refer to the ‘Access Control’ section in the user manual
• User Manual: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=PHA83350.03.pdf&p_Doc_Ref=PHA83350
• Use IPSEC to help secure Ethernet communication.
• Download the firmware updates from the Schneider Electric website and verify the firmware integrity
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

BMENOR2200H V3.02.02 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product/BMENOR2200H/x80-advanced-rtu-module-ethernet-based-1-serial-port-hardened/If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: •Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP  •Configure BMENOR2200H module to operate in Secured mode. Refer to the user manual below in the section ‘Cyber Security Configuration’ and change the default passwords. •Configure role-based access control and local authentication for users of BMENOR2200H module. Refer to the ‘RBAC’ section in the user manual  •User Manual: https://download.schneider-electric.com/files?p_Doc_Ref=PHA90072&p_enDocType=User+guide&p_File_Name=PHA90072.02.pdf•Use IPSEC to help secure Ethernet communication. •Download the firmware updates from the Schneider Electricwebsite and verify the firmware integrityTo ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2022-34760

A CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability exists that could cause a denial of service of the webserver due to improper handling of the cookies.

CVE Description

CVE-2022-34764

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory

CVE Description

CVE-2022-34761

A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a denial of service of the webserver when parsing JSON content type.

CVE Description

CVE-2022-34762

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause unauthorized firmware image loading when unsigned images are added to the firmware image path.

CVE Description

CVE-2022-34763

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could cause loading of unauthorized firmware images due to improper verification of the firmware signature.

CVE Description

CVE-2022-34765

A CWE-73: External Control of File Name or Path vulnerability exists that could cause loading of unauthorized firmware images when user-controlled data is written to the file path.

CVE Description


Summary: Original Release

Summary: SpaceLogic C-Bus Home Controller, formerly known as C-Bus Wiser Home Controller MK2 - SEVD-2022-193-02 CSAF Version

Summary: SpaceLogic C-Bus Home Controller, formerly known as C-Bus Wiser Home Controller MK2 - SEVD-2022-193-02 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2.
The SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Home Controller MK2 is a home automation controller product.
Failure to apply the remediations provided below may risk an OS command injection vulnerability, which could result in a remote root exploit.

Overview

Schneider Electric

Schneider Electric SpaceLogic C-Bus Home Controller (5200WHC2) <=V1.31.460

PICED installer

Schneider Electric PICED installer V4.14.0

CVE-2022-34753

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised.

CVE Description

Customers need to use V4.14.0 of PICED installer to install the updates that remediate this vulnerability, available here:
https://www.se.com/ww/en/product-range/2216-spacelogic-cbus-home-automation-system/?parent-subcategory-id=88010&filter=business-5-residential-and-small-business#software-and-firmware
A reboot is needed.


Acti9 PowerTag Link C

Summary: Original Release

Summary: Acti9 PowerTag Link C - SEVD-2022-193-03 CSAF Version

Summary: Acti9 PowerTag Link C - SEVD-2022-193-03 PDF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Acti9 PowerTag Link C product.
The Acti9 PowerTag Link C is the simplest and most efficient way to achieve a fully connected panel.
Failure to apply the remediation provided below may risk an improper access control attack, which could result in unauthorized access to other network devices.

Overview

Schneider Electric

Acti9 PowerTag Link C (A9XELC10-A)

Schneider Electric Acti9 PowerTag Link C (A9XELC10-A) <V1.7.5

Schneider Electric Acti9 PowerTag Link C (A9XELC10-A) V2.14.0

Acti9 PowerTag Link C (A9XELC10-B)

Schneider Electric Acti9 PowerTag Link C (A9XELC10-B) <=V2.12.0

Schneider Electric Acti9 PowerTag Link C (A9XELC10-B) V2.14.0

CVE-2022-34754

A CWE-269: Improper Privilege Management vulnerability exists that could allow elevated functionality when guessing credentials.

CVE Description

Firmware V2.14.0 includes a fix for this vulnerability. Please note that firmware updates are performed automatically. A reboot is automatically performed after the firmware update. The firmware version information is available by using the FESB mobile application
Contact Schneider Electric’s Customer Care Center if you need assistance.


Easergy P5

Summary: Original Release

Summary: Easergy P5 - SEVD-2022-193-04 CSAF Version

Summary: Easergy P5 - SEVD-2022-193-04 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Easergy P5 product line.
The Easergy P5 is a medium voltage protection relay.
Failure to apply the mitigations or remediations provided below may risk disclosure of the device’s credentials, denial of service, device reboot, or an attacker could gain full control of the relay. This could result in loss of protection of your electrical network.

Overview

Schneider Electric

Easergy P5

Schneider Electric Easergy P5 <=V01.401.102

Schneider Electric Easergy P5 V01.402.101

CVE-2022-34756

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI.

CVE Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

V01.402.101 of the Easergy P5 firmware includes a fix for these vulnerabilities and is available on request from Schneider Electric’s Customer Care Center.

Disable the device Web HMI by using the Easergy Pro to turn off the HTTPS server in the communication menu.

CVE-2022-34757

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pro software and the device, which may allow an attacker to observe protected communication details.

CVE Description

If the device firmware version is prior to V01.401.101, limit the use of Easergy Pro software to the front USB port. The option to disable SSH on the rear Ethernet board is not yet available in this version of the firmware.

If the device firmware is V01.401.101 to V01.402.001:
• Disable the SSH on the rear Ethernet port and use
only Easergy Pro on the front USB port.
• If you are using Easergy Pro software on the rear Ethernet port, disable SSH on the rear Ethernet port when it is not in use

CVE-2022-34758

A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged user credentials.

CVE Description

Timothée Chauvin
Paul Noalhyt
Yuanzhe Wu

Follow the General Security Recommendations.


Summary: Original Release

Summary: The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

Summary: A clarification was added to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 V4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document

Summary: The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

Summary: A remediation is available for the Modicon M580 CPU Safety (page 2)

Summary: EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, and Modicon Controllers M580 and M340 - SEVD-2022-221-01 PDF Version

Summary: EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, and Modicon Controllers M580 and M340 - SEVD-2022-221-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert, and Modicon M580 and M340 control products.
Failure to apply the remediations provided below may risk a bypass of access controls in place, which could result in the possibility of arbitrary code execution and loss of confidentiality and integrity of the project file.
March 2023 Update: Remediation for the Modicon M580 CPU is available for download

Overview

Schneider Electric

EcoStruxure™ Control Expert

<=15.0 SP1

Schneider Electric EcoStruxure™ Control Expert <=15.0 SP1

Schneider Electric EcoStruxure™ Control Expert 15.1

EcoStruxure™ Process Expert

Schneider Electric EcoStruxure™ Process Expert <2021

Schneider Electric EcoStruxure™ Process Expert 2021

Modicon M340 CPU

Schneider Electric Modicon M340 CPU <=3.40

Schneider Electric Modicon M340 CPU 3.50

Modicon M580 CPU

Schneider Electric Modicon M580 CPU <=3.22

Modicon M580 CPU Safety

< SV4.21

Schneider Electric Modicon M580 CPU Safety Versions prior to SV4.21

Modicon M580 CPU Safety <SV4.10

Schneider Electric Modicon M580 CPU Safety <SV4.10

Modicon M580 CPU Safety SV4.10

Schneider Electric Modicon M580 CPU Safety SV4.10

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety Versions SV4.21

CVE-2022-37300

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus.

CVE Description

EcoStruxure Control Expert V15.1, available for download below, includes a fix for this vulnerability
https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_V15.1/

EcoStruxure™ Process Expert V2021, available for download below, includes a fix for this vulnerability:
https://www.se.com/myschneider/documentsDownloadCenterDetail/in/en/EPE2021Release

Firmware V3.50 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/

Firmware SV4.21 includes a fix for these vulnerabilities and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac-controller/#software-and-firmware
 Important: customer needs to use version of EcoStruxure™
Control Expert V16.0 HF001 minimum to connect with the latest
version of M580 CPU Safety. The software is available for
download here: tps://www.se.com/ww/en/product-range/548-ecostruxurecontrol-expert-unity-pro/#software-and-firmware

The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. For specific questions or support, Customers are requested to contact Schneider Electric’s Customer Care Center. Please refer to the mitigations recommended in the section below.

• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
o “Modicon M580, Hardware, Reference Manual” https://www.se.com/ww/en/download/document/EIO0000001578/
o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/
• Setup a VPN between the Modicon PLC controllers and the engineering workstation containing EcoStruxure Control Expert or Process Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage
• Harden the workstation running EcoStruxure™ Control Expert and EcoStruxure™ Process Expert

Schneider Electric is establishing a remediation plan for all future versions of M580 CPU Safety that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • Setup an application password in the project properties.
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP.
• Configure the Access Control List following the recommendations of the user manuals:
o “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
• Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
 https://www.se.com/ww/en/download/document/HRB62665/
• Ensure the M580 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers.
Platform Cyber Security Reference Manual”, “CPU Memory Protection section”:https://www.schneider-electric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication
 To further reduce the attack surface on Modicon M580 CPU Safety:
• Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

Firmware SV4.10 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/


Modicon PAC Controllers

Summary: Original Release

Summary: The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. For specific questions or support, Customers are requested to contact Schneider Electric’s Customer Care Center.Please refer to the mitigations recommended in the section below.

Summary: A remediation is available for Modicon Momentum Unity M1E processor and for the Modicon M580 CPU (page 2).

Summary: A remediation is available for the Modicon M580 CPU Safety (page 2).

Summary: Modicon PAC Controllers - SEVD-2022-221-02 PDF Version

Summary: Modicon PAC Controllers - SEVD-2022-221-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon PAC Controllers.
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way.
Failure to apply the remediations provided below may risk memory related errors, which could result in Denial of Service of the controller when using Modbus TCP.
September 2022 Update: A remediation is available for Modicon MC80 (BMKC80) Controller
March 2023 Update: A remediation is available for Modicon Momentum Unity M1E processor and for the Modicon M580 CPU

Overview

Schneider Electric

Modicon M580 CPU

Schneider Electric Modicon M580 CPU 4.01

Modicon MC80

Schneider Electric Modicon MC80 all versions

Modicon Momentum MDI CPU

Schneider Electric Modicon Momentum MDI CPU <=2.5

Legacy Modicon Quantum /Premium

Schneider Electric Legacy Modicon Quantum /Premium all versions

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)Versions prior to SV4.21

Modicon M580 CPU

Schneider Electric Modicon M580 CPU 4.10

Modicon Momentum MDI CPU

Schneider Electric Modicon Momentum MDI CPU 2.6

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)Version SV4.21

CVE-2022-37301

A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations when using the Modbus TCP protocol.

CVE Description

Firmware V3.50 of Modicon includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/

Firmware SV4.10 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/

Firmware SV2.6 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/Momentum_FW_update/

Schneider Electric’s Modicon Quantum controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our current product offer.
Customers should strongly consider migrating to the Modicon M580 ePAC.
Please contact your local Schneider Electric technical support for more information.

• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
o “Modicon M580, Hardware, Reference Manual” https://www.se.com/ww/en/download/document/EIO0000001578/
o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
o “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000002071.02.pdf&p_Doc_Ref=EIO0000002071
o “Momentum for EcoStruxure™ Control Expert - 171 CBU 78090, 171 CBU 98090, 171 CBU 98091 Processors” manual in the chapter “Modbus Messaging and Access Control” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=HRB44124.08.pdf&p_Doc_Ref=HRB44124
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
• Ensure the M580 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”:
https://www.schneider-electric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication• Setup a VPN between the Modicon PLC controller and the engineering workstation containing EcoStruxure Control Expert or Process Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.
To further reduce the attack surface on Modicon M580 CPU Safety:
• Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/
 To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

If customers choose not to upgrade, they should immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List feature as mentioned in “Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter “Software Settings for Ethernet Communication / Messaging / Quantum NOE Ethernet Messaging Configuration”: https://www.se.com/ww/en/download/document/33002467K01000/
• Configure the Access Control List following the recommendations of the user manual “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP Services Configuration Parameters / Connection Configuration Parameters”: https://www.se.com/ww/en/download/document/35006192K01000/

Firmware V1.8 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/62396-modicon-mc80/#software-and-firmware


EcoStruxure™ Control Expert

Summary: Original Release

Summary: EcoStruxure™ Control Expert - SEVD-2022-221-03 PDF Version

Summary: EcoStruxure™ Control Expert - SEVD-2022-221-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Control Expert product.
EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon M340, M580, M580S, Premium, Momentum and Quantum ranges.
Failure to apply the remediations provided below may risk the EcoStruxure™ Control Expert software to crash.

Overview

Schneider Electric

EcoStruxure™ Control Expert

<=15.1 HF001

Schneider Electric EcoStruxure™ Control Expert version 15.1 HF001 and prior

Schneider Electric EcoStruxure™ Control Expert 15.2

CVE-2022-37302

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a crash of the Control Expert software when an incorrect project file is opened.

CVE Description

V15.2 of EcoStruxure™ Control Expert includes a fix for this vulnerability and is available for download here:
 https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_V15.2/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Configure the “file encryption” feature available in EcoStruxure™ Control Expert
• Customers are recommended to share project files only when configured with the encryption feature described above.
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Only open project files received from trusted source
• Harden the workstation running EcoStruxure™ Control Expert


Modicon PAC Controllers

Summary: Original Release

Summary: Remediation for the Modicon M580 CPU is available for download (page 2).

Summary: Modicon PAC Controllers - SEVD-2022-221-04 PDF Version

Summary: Modicon PAC Controllers - SEVD-2022-221-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon PAC Controllers.
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient and protected way.
Failure to apply the remediations provided below may risk read access to memory content of the controllers, which could result in exposure of sensitive information such as application password hash and project data to the attacker.
September 2022 Update: The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

Overview

Schneider Electric

Modicon M340 CPU

Schneider Electric Modicon M340 CPU version 3.30 and prior

Schneider Electric Modicon M340 CPU 3.40

Modicon M580 CPU

Schneider Electric Modicon M580 CPU version 3.22 and prior

Modicon MC80

Schneider Electric Modicon MC80 version 1.6 and prior

Modicon MOMENTUM CPU

Schneider Electric Modicon MOMENTUM CPU version 2.3 and prior

Schneider Electric Modicon MOMENTUM CPU SV2.4

Legacy Modicon Quantum

Schneider Electric Legacy Modicon Quantum all versions

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions prior to SV4.21

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Version SV4.21

CVE-2021-22786

A CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive information stored on the memory of the controller when communicating over the Modbus TCP protocol.

CVE Description

Exposure of Sensitive Information to an Unauthorized Actor

Firmware V3.40 of Modicon includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_xx.xx/

Firmware v1.70 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMKC80_Firmware_upgrade/

Firmware SV2.4 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/Momentum_FW_update/

Firmware SV4.21 includes a fix for these vulnerabilities and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac-controller/#software-and-firmware
 Important: customer needs to use version of EcoStruxure™
Control Expert V16.0 HF001 minimum to connect with the latest
version of M580 CPU Safety. The software is available for
download here: tps://www.se.com/ww/en/product-range/548-ecostruxurecontrol-expert-unity-pro/#software-and-firmware

• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
o “Modicon M580, Hardware, Reference Manual” https://www.se.com/ww/en/download/document/EIO0000001578/
o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
o “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000002071.02.pdf&p_Doc_Ref=EIO0000002071
o “Momentum for EcoStruxure™ Control Expert - 171 CBU 78090, 171 CBU 98090, 171 CBU 98091 Processors” manual in the chapter “Modbus Messaging and Access Control” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=HRB44124.08.pdf&p_Doc_Ref=HRB44124
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
• Setup a VPN between the Modicon PLC controller and the engineering workstation containing EcoStruxure Control Expert or Process Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List feature as mentioned in “Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter “Software Settings for Ethernet Communication / Messaging / Quantum NOE Ethernet Messaging Configuration”: https://www.se.com/ww/en/download/document/33002467K01000/

If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP. • Configure the Access Control List following the recommendations of the user manual “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/ • Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/ • Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350 • Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 – BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/ To further reduce the attack surface on Modicon M580 CPU Safety: • Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”: https://www.se.com/ww/en/download/document/QGH60283/


Summary: Original Release

Summary: EcoStruxure Machine SCADA Expert  Pro-face BLUE Open Studio - SEVD-2022-256-01 PDF Version

Summary: EcoStruxure Machine SCADA Expert  Pro-face BLUE Open Studio - SEVD-2022-256-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Machine SCADA Expert and Pro-face BLUE Open Studio products. EcoStruxure Machine SCADA Expert is a powerful software for developing HMI, SCADA, OEE and Dashboard projects dedicated to Line Management & Lite Supervision applications to run in Harmony Industrial PC and GTU Open Box.  Pro-face BLUE Open Studio is a development and runtime software that incorporates all of the tools users need to create SCADA HMI applications, dashboards and OEE interfaces. Failure to apply the mitigations provided below may risk a modification of project files which could result in arbitrary code execution, information disclosure, or denial of service.

Overview

Schneider Electric

Schneider Electric EcoStruxure Machine SCADA Expert  2020 Service Pack 2 version 20.0.2 and prior

HotFix 2020.2.00.40

Schneider Electric EcoStruxure Machine SCADA Expert  2020 Service Pack 2 Hot Fix 2020.2.00.40

BLUE Open Studio  2020 Service Pack 2

Schneider Electric BLUE Open Studio  2020 Service Pack 2 version 20.0.2 and prior

BLUE Open Studio  2020 Service Pack 2

HotFix 2020.2.00.40

Schneider Electric BLUE Open Studio  2020 Service Pack 2 HotFix 2020.2.00.40

CWE-502: Deserialization of Untrusted Datavulnerability exists that can lead to arbitrary code execution, information disclosure, or denial of services when the project file is loaded. Successful exploitation of the vulnerabilities requires user interaction and write access to HMI project file.

CVE Description

Version 2020 Service Pack 2 Hot Fix 2020.2.00.40 of EcoStruxure Machine SCADA Expert includes a fix for this vulnerability. Please contact your Schneider Electric Customer Care Center to obtain the Hot Fix. For additional detail please refer to the supplied help file in Hot Fix2020.2.00.4

Version 2020 Service Pack 2 Hot Fix 2020.2.00.40 of BLUE Open Studio includes a fix for this vulnerability. Please contact your Pro-face Customer Care Center to obtain the Hot Fix. For additional detail please refer to the supplied help file in Hot Fix2020.2.00.40.

In addition to applying the remediations provided above, the following general precautions should be taken throughout the lifetime of EcoStruxure Machine SCADA Expert projects and BLUE Open Studio projects:
•Access Control Lists should be applied to all folders where users will save and load projectfiles.
•Enforce a trusted chain-of-custody on project files, maintained during creation, modification, distribution, and use.
•Train users to always verify the source of a project is trusted before opening/executing it.


Summary: Original Release

Summary: EcoStruxure™ Operator Terminal Expert and Pro-face BLUE - SEVD-2022-284-01 PDF Version

Summary: EcoStruxure™ Operator Terminal Expert and Pro-face BLUE - SEVD-2022-284-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products.
The EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products are HMI configuration software supporting gestures and UI designs.
Failure to apply the remediations provided below may risk unauthorized code execution by a local user of the Windows engineering workstation, which could result in loss of availability, integrity, and confidentiality of the workstation where EcoStruxure™ Operator Terminal Expert or Pro-face BLUE runtime is installed.

Overview

Schneider Electric

EcoStruxure™ Operator Terminal Expert

Schneider Electric EcoStruxure™ Operator Terminal Expert <3.3

Schneider Electric EcoStruxure™ Operator Terminal Expert 3.3

CVE-2022-41666

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code.

CVE Description

EcoStruxure™ Operator Terminal Expert V3.3 Service Pack 1 includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/62621-ecostruxure-operator-terminal-expert/#software-and-firmware
This fix is also available through Schneider Electric Software Update (SESU).

Pro-face BLUE V3.3 Service Pack 1 includes a fix for these vulnerabilities and is available for download here:
https://www.proface.com/en/service#/blue/page/installer
This fix is also available through Schneider Electric Software Update (SESU).

CVE 2022-41667

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privileges to load a malicious DLL which could lead to execution of malicious code.

CVE Description

CVE-2022-41668

A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-controlled network share which could result in execution of malicious code.

CVE Description

CVE-2022-41669

CVE Description

CVE-2022-41670

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversaries with local user privileges to load malicious DLL which could result in execution of malicious code.

CVE Description

CVE-2022-41671

A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privileges to craft a malicious SQL query and execute as part of project migration which could result in execution of malicious code.

CVE Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')


EcoStruxure™ Panel Server Box (PAS900)

Summary: Original Release

Summary: EcoStruxure™ Panel Server Box (PAS900) - SEVD-2022-284-02 PDF Version

Summary: EcoStruxure™ Panel Server Box (PAS900) - SEVD-2022-284-02 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Panel Server Box (PAS900) product.
The EcoStruxure™ Panel Server Box (PAS900) product is a cloud connected gateway with 4G/WIFI/Ethernet that supports Modbus TCP/RTU for south communication.
Failure to apply the remediations provided below may risk a Hole Descriptor overwrite attack or buffer overflow, which could result in arbitrary write or Denial of Service.

Overview

Schneider Electric

EcoStruxure™ Panel Server Box

Schneider Electric EcoStruxure™ Panel Server Box (PAS900) <3.1.16

Schneider Electric EcoStruxure™ Panel Server Box (PAS900) 3.1.18

CVE-2022-30790

A CWE-787: Out-of-Bounds Write vulnerability exists that could cause arbitrary writes when crafted malformed packets are received from a local network while U-boot is running.
Note: The CVSS score provided above is calculated in the context of EcoStruxure™ Panel Server Box.

CVE Description

Version 3.1.18 of Schneider EcoStruxure™ Panel Server Box (PAS900) includes a fix for these vulnerabilities and is available for download in the EMOP cloud platform:
• Login to the Schneider QianLiYan (千里眼) and navigate to the EMOP device management portal.
• Follow online firmware update tips and guidelines.
OR
• Download the latest version from EMOP cloud and do the firmware update via local web page.
• Use the QuianLiYan(千里眼) to verify that the firmware was updated successfully.

CVE-2022-30552

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause Denial of Service when a specially crafted fragmented IP Datagram with an invalid total length is received from a local network while U-boot is running.
Note: The CVSS score provided above is calculated in the context of EcoStruxure™ Panel Server Box.

CVE Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the third party ISaGRAF Workbench software used by SAGE RTU products.
The SAGE RTU products are hardware devices that collect utility substation information from different devices and passes it along to a SCADA software platform.
Failure to apply the mitigations provided below may risk remote code execution, which could result in privilege escalation that will allow an attacker to gain the privileges of the software. If the software is running at SYSTEM level, an attacker may gain admin level privileges. These vulnerabilities can only be exploited when users open the TCP listening ports on the RTU and connect with ISaGRAF Workbench.

Overview

Summary: ISaGRAF Workbench for SAGE RTU - SEVD-2022-284-03 PDF Version

Summary: ISaGRAF Workbench for SAGE RTU - SEVD-2022-284-03 CSAF Version

ISaGRAF Workbench for SAGE RTU

Summary: Original Release

Summary: Corrected Known Affected Versions for SAGE RTU

Schneider Electric

SAGE RTU C3414 CPU

Schneider Electric SAGE RTU C3414 CPU (Current) Version C3414-500-S02K5_P5

Rockwell Automation

ISaGRAF Workbench

Rockwell Automation ISaGRAF Workbench Versions 6.0 through 6.6.9 optional component of Schneider Electric SAGE RTU C3414 CPU (Current) Versions prior to C3414-500-S02K5_P5

Rockwell Automation ISaGRAF Workbench Versions 6.0 through 6.6.9 optional component of Schneider Electric SAGE RTU C3413 CPU (Obsolete CPU) All firmware versions

Rockwell Automation ISaGRAF Workbench Versions 6.0 through 6.6.9 optional component of Schneider Electric SAGE RTU C3412 CPU (Obsolete CPU) All firmware versions

ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal
vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of
the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level,
then the attacker will gain admin level privileges. User interaction is required for this exploit to be
successful.
Note: The CVSS score provided above is calculated in the context of SAGE RTU.

CVE Description

Version C3414-500-S02K5_P5 of SAGE RTU CPU 3414 includes a mitigation for these vulnerabilities and is available for download here:
https://www.sage-rtu.com/downloads.html
Reboot of SAGE RTU is required after firmware upgrade.
This mitigation disables the ISaGRAF listening TCP ports by default and provides an additional network service checkbox to allow customers to enable the ISaGRAF ETCP task, which will open the TCP listening ports to connect with ISaGRAF workbench when needed, and to disable the TCP listening ports when ISaGRAF Workbench development, debugging, and downloading tasks are complete.
These vulnerabilities can only be exploited when users reopen the listening ports and connect with ISaGRAF workbench. These vulnerabilities only apply when a non-secure network is being used to perform development tasks in non-runtime applications. It is our recommendation to mitigate these vulnerabilities by performing all ISaGRAF workbench tasks on a secure network or on a private network when connecting to the device.
OR
If firmware is not upgraded to C3414-500-S02K5_P5, but customers are running firmware version C3414-500-S02K2 or above, then they should immediately apply the following mitigations to reduce the risk of exploit:
If ISaGRAF is configured and in use, the built-in firewall can be used to disable ISaGRAF port 1131 and 1113 when the debugger is not in use. Use the following commands in the Firewall configuration to disable external access to ISaGRAF:
Block in proto tcp from any to any port = 1131
Block in proto tcp from any to any port = 1113
If ISaGRAF is NOT configured and in use, the ISaGRAF port is by default not enabled and does not start automatically, therefore there is no impact of these vulnerabilities, and no further action is required by customers.

SAGE RTU CPU’s C3413 and C3412 have reached their end of life and are no longer supported. Customers should immediately upgrade to the latest CPU C3414 and apply C3414-500-S02K5_P5 or later firmware which can be downloaded here:
https://www.sage-rtu.com/downloads.html
Reboot of SAGE RTU is required after firmware upgrade.
This mitigation disables the ISaGRAF listening TCP ports by default and provides an additional network service checkbox to allow customers to enable the ISaGRAF ETCP task, which will open the TCP listening ports to connect with ISaGRAF workbench when needed, and to disable the TCP listening ports when ISaGRAF Workbench development, debugging, and downloading tasks are complete.
These vulnerabilities can only be exploited when users reopen the listening ports and connect with ISaGRAF workbench. These vulnerabilities only apply when a non-secure network is being used to perform development tasks in non-runtime applications. It is our recommendation to mitigate these vulnerabilies by performing all ISaGRAF workbench tasks on a secure network or on a private network when connecting to the device.

CVE-2022-2463

ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the ISaGRAF Workbench software. User interaction is required for this exploit to be successful.
Note: The CVSS score provided above is calculated in the context of SAGE RTU.

CVE Description

CVE-2022-2464

ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in ISaGRAF Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.
Note: The CVSS score provided above is calculated in the context of SAGE RTU.

CVE Description

CVE-2022-2465


Summary: Original Release

Summary: There is an update to the EcoStruxure™ Power SCADA Operation 2020 remediation advising customers to move to 2020 R2 instead of 2020 CU2

Summary: EcoStruxure™ Power Operation 2021, EcoStruxure™ Power SCADA Operation 2020 and EcoStruxure™ Power SCADA Operation 2020 R2 - SEVD-2022-284-04 PDF Version

Summary: EcoStruxure™ Power Operation 2021, EcoStruxure™ Power SCADA Operation 2020 and EcoStruxure™ Power SCADA Operation 2020 R2 - SEVD-2022-284-04 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Operation and Power SCADA Operation software. EcoStruxure™ Power Operation and EcoStructure™ Power SCADA Operation are on-premises software offers that provides a single platform to monitor and control medium and lower power systems.
Failure to apply the remediation provided below may risk result in a loss of data confidentiality, data integrity issues, or a loss of access to the server.

Overview

Schneider Electric

EcoStruxure™ Power SCADA Operation

2020 CU1

Schneider Electric EcoStruxure™ Power SCADA Operation 2020 CU1

Schneider Electric EcoStruxure™ Power SCADA Operation2020 R2 version prior to CU1

Schneider Electric EcoStruxure™ Power SCADA Operation 2020 R2 version CU1 and later

EcoStruxure™ Power Operation 2021

2021 CU2

Schneider Electric EcoStruxure™ Power Operation 2021 CU2

EcoStruxure™ Power Operation 2021

2021 CU1

Schneider Electric EcoStruxure™ Power Operation 2021 CU1

EcoStruxure™ Power Operation 2021

2021 Cumulative Update 3 (CU3)

Schneider Electric EcoStruxure™ Power Operation 2021 2021 Cumulative Update 3 (CU3)

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated attacker to view data, change settings, impact availability of the software, or potentially impact a user’s local machine when the user clicks a specially crafted link.

CVE Description

Power SCADA Operation 2020 R2 Cumulative Update 1 (CU1) or newer, if available, includes a fix for this vulnerability and is available for download here: https://community.exchange.se.com/t5/EcoStruxure-Power-Operation/Downloads-Installers-Cumulative-Updates-and-Drivers/td-p/152169Please note: these updates are made available through the Schneider Electric Exchange community. If you are unable to access this service, please contact Schneider Electric Customer Care Center for assistance in accessing these updates.

Power SCADA Operation 2020 R2 Cumulative Update 1 (CU1) or newer, if available, includes a fix for this vulnerability and is available for download here:
https://community.exchange.se.com/t5/EcoStruxure-Power-Operation/Downloads-Installers-Cumulative-Updates-and-Drivers/td-p/152169
Please note: these updates are made available through the Schneider Electric Exchange community. If you are unable to access this service, please contact Schneider Electric Customer Care Center for assistance in accessing these updates.

Power Operation 2021 Cumulative Update 3 (CU3) or newer, if available, includes a fix for this vulnerability and is available for download here:
https://community.exchange.se.com/t5/EcoStruxure-Power-Operation/Downloads-Installers-Cumulative-Updates-and-Drivers/td-p/152169
Please note: these updates are made available through the Schneider Electric Exchange community. If you are unable to access this service, please contact Schneider Electric Customer Care Center for assistance in accessing these updates.


NetBotz 4 - 355/450/455/550/570

Summary: Original Release

Summary: The CVSS scores were updated.

Summary: NetBotz 4 - 355/450/455/550/570 - SEVD-2022-312-01 PDF Version

Summary: NetBotz 4 - 355/450/455/550/570 - SEVD-2022-312-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its NetBotz 4 - 355/450/455/550/570 products.
The NetBotz 4 - 355/450/455/550/570 products are security and environmental monitors providing temperature, humidity, leak, smoke, vibration, door contact, and video monitoring capabilities.
Failure to apply the remediation provided below may risk device attacks which could result in device manipulation and unauthorized device access.
February 2023 Update: The CVSS scores were updated.

Overview

Schneider Electric

NetBotz 4 - 355

Schneider Electric NetBotz 4 - 355 version 4.7.0 and prior

NetBotz 4 - 450

Schneider Electric NetBotz 4 - 450 version 4.7.0 and prior

NetBotz 4 - 455

Schneider Electric NetBotz 4 - 455 version 4.7.0 and prior

NetBotz 4 - 550

Schneider Electric NetBotz 4 - 550 version 4.7.0 and prior

NetBotz 4 - 570

Schneider Electric NetBotz 4 - 570 version 4.7.0 and prior

NetBotz 4 - 355

Schneider Electric NetBotz 4 - 355 4.7.2

NetBotz 4 - 450

Schneider Electric NetBotz 4 - 450 4.7.2

NetBotz 4 - 455

Schneider Electric NetBotz 4 - 455 4.7.2

NetBotz 4 - 550

Schneider Electric NetBotz 4 - 550 4.7.2

NetBotz 4 - 570

Schneider Electric NetBotz 4 - 570 4.7.2

CVE-2022-43376

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')vulnerability exists that could cause code and session manipulation when malicious code is inserted into the browser.

CVE Description

Version 4.7.2of NetBotz 4 -355/450/455/550/570includes a fix for these vulnerabilities and is available for download. Upon upgrade the system will automatically reboot. Verify the upgrade was successful by ensuring it is running version 4.7.2.

CVE-2022-43377

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is performed on the account

CVE Description

CVE-2022-43378

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended actions when external address frames are not properly restricted.

CVE Description


APC Easy UPS Online Monitoring Software

Summary: Original Release

Summary: Schneider Electric Easy UPS Online Monitoring Software was added to the list of impacted products, and remediation links were updated.

Summary: APC Easy UPS Online Monitoring Software - SEVD-2022-347-01 PDF Version

Summary: APC Easy UPS Online Monitoring Software - SEVD-2022-347-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its APC Easy UPS Online Monitoring Software.
The APC Easy UPS Online Monitoring Software is used to configure and manage APC Easy UPS.
Failure to apply the remediations provided below may risk remote code execution, escalation of privileges, or authentication bypass, which could result in execution of malicious web code or loss of device functionality.

Overview

Schneider Electric

Schneider Electric APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 Windows Server 2016, 2019, 2022) <=2.5-GA

Schneider Electric APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022) <=2.5-GA-01-22261

APC Easy UPS Online Monitoring Software

Schneider Electric APC Easy UPS Online Monitoring Software 2.5-GA-01-22320

Schneider Electric Easy UPS Online Monitoring Software  (Windows 7, 10, 11 Windows Server 2016, 2019, 2022) <=2.5-GA

Schneider Electric Easy UPS Online Monitoring Software  (Windows 11, Windows Server 2019, 2022) <=2.5-GA-01-22261

Schneider Electric Easy UPS Online Monitoring Software  2.5-GA-01-22320

CVE-2022-42970

A CWE-306: Missing Authentication for Critical Function The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

CVE Description

Version 2.5-GA-01-22320of APC Easy UPS Online Monitoring Software includes a fix for the vulnerabilities impacting Windows 7, 10, 11, and Windows Server 2016, 2019, and 2022 and is available for direct download here: https://download.schneider-electric.com/files?p_Doc_Ref=APC_install_APC_UPS_windows&p_enDocType=Software+-+Release&p_File_Name=installAPCUPS_windows-2.5-GA-01-22320.zip

Version 2.5-GS-01-22320of Schneider Electric Easy UPS Online Monitoring Software includes a fix for the vulnerabilities impacting Windows 7, 10, 11, and Windows Server 2016, 2019, and 2022 and is available for direct download here: https://download.schneider-electric.com/files?p_Doc_Ref=Install_Schneider_UPS_windows&p_enDocType=Software+-+Release&p_File_Name=installSchneiderUPS_windows.zip

CVE-2022-42971

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could cause remote code execution when the attacker uploads a malicious JSP file.

CVE Description

CVE-2022-42972

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory.

CVE Description

CVE-2022-42973

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database.

CVE Description


Saitel DR RTU

Summary: Original Release

Summary: Saitel DR RTU - SEVD-2022-347-02 PDF Version

Summary: Saitel DR RTU - SEVD-2022-347-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Triangle MicroWorks DNP3 Outstation
Libraries used in the Saitel DR RTU (Remote Terminal Unit).
The SAITEL DR RTU is a field device, offering a solid and powerful platform for data acquisition,
communication, automation and IED integration for distribution and transmission networks,
generation sector and railway.
Failure to apply the remediation provided below may lead to a denial of service of the DNP3
communication and will result in a loss of remote access to the device.

Overview

Schneider Electric

SAITEL DR RTU

Schneider Electric SAITEL DR RTU version prior to 11.06.14

Schneider Electric SAITEL DR RTU version 11.06.15

CVE-2020-6996

A CWE-787: Out-of-bounds write vulnerability exists that could cause a denial of service when an attacker gains access to the RTU communication network.

CVE Description

Version BaseLine_11.06.15 of Saitel DR RTU includes a fix for this vulnerability and is available from your Schneider Electric Saitel sales contact