PowerLogic PM5500 and PowerLogic PM8ECC

Summary: Original Release

Summary: Remediation now available for PM5562.

Summary: PowerLogic PM5500 and PowerLogic PM8ECC - SEVD-2022-159-02 PDF Version

Summary: PowerLogic PM5500 and PowerLogic PM8ECC - SEVD-2022-159-02 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Overview
Schneider Electric is aware of a vulnerability in its PowerLogic PM55xx and PowerLogic
PM8ECC products.
The PowerLogic PM55xx products are power metering devices. The PowerLogic PM8ECC
product is an ethernet communication module.
Failure to apply the mitigations or remediations provided below may risk elevation of privileges,
which could result in loss of control of the affected device.

Overview

Schneider Electric

PowerLogic PM5560

Schneider Electric PowerLogic PM5560 Versions prior to v2.7.8

PowerLogic PM5561

Schneider Electric PowerLogic PM5561 Versions prior to v10.7.3

PowerLogic PM5562

Schneider Electric PowerLogic PM5562 v2.5.4 and prior

PowerLogic PM5563

Schneider Electric PowerLogic PM5563 Versions prior to v2.7.8

PowerLogic PM8ECC

Schneider Electric PowerLogic PM8ECC All Versions

PowerLogic PM5560

Schneider Electric PowerLogic PM5560 v2.8.3

PowerLogic 5563

Schneider Electric PowerLogic PM5563 v2.8.3

PowerLogic PM5561

Schneider Electric PowerLogic PM5561 v10.7.3

PowerLogic PM5562

Schneider Electric PowerLogic PM5562 v4.3.5

Schneider Electric PowerLogic PM5562 Versions prior to v4.3.5

CVE-2021-22763

CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists
that could allow an attacker administrator level access to a device.

CVE Description

Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware
includes fixes for these vulnerabilities. The version update files
are available for download here:
https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-and-control -
software-and-firmware
If customers choose not to apply the remediation provided
above, they should immediately apply the following mitigation to
reduce the risk of exploit:
Customers should consider blocking HTTP access to the device
at the firewall level or disable the HTTP web service to reduce
the risk of exposure.

Version 10.7.3 of the PowerLogic PM5561 firmware includes
fixes for these vulnerabilities. The version update files are
available for download here:
https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-andcontrol#software-and-firmware
If customers choose not to apply the remediation provided
above, they should immediately apply the following mitigation to
reduce the risk of exploit:
Customers should consider blocking HTTP access to the device
at the firewall level or disable the HTTP web service to reduce
the risk of exposure.

Version 4.3.5 of the PowerLogic PM5562 firmware includes
fixes for these vulnerabilities. The version update files are
available for download here:
https://www.se.com/ww/en/product-range/61281-powerlogicpm5000/12146169702-basic-multifunction-metering/?selectednode-id=12146169702&N=brand=se%26countrycode=UK%26language-code=en%26node-id=12146169702 -
software-and-firmware
If customers choose not to apply the remediation provided
above, they should immediately apply the following mitigation to
reduce the risk of exploit:
Customers should consider blocking HTTP access to the
device at the firewall level or disable the HTTP web service to
reduce the risk of exposure.

PowerLogic PM8ECC has reached end of service and is no
longer supported. Customers should immediately apply the
following mitigation to reduce the risk of exploit:
Customers should consider blocking HTTP access to the device
at the firewall level once commissioning is complete to reduce
the risk of exposure. Additionally, Customers should ensure the
General security Recommendations listed below are in place.

CVE-2021-22764

CWE-287: Improper Authentication vulnerability exists that could cause loss of connectivity to
the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.

CVE Description


PowerLogic EGX100 and PowerLogicEGX300

Summary: Original Release

Summary: PowerLogic EGX100 and PowerLogicEGX300 - SEVD-2021-159-03 PDF Version

Summary: PowerLogic EGX100 and PowerLogicEGX300 - SEVD-2021-159-03 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its PowerLogic EGX100 and EGX300
products.
The PowerLogic EGX100 and EGX300 are communication gateway devices.
Failure to apply the mitigations provided below may risk denial of service or remote code
execution, which could result in loss of device functionality.

Overview

Schneider Electric EGX100 Versions 3.0.0 and newer

CVE-2021-22763

CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability
exists that could allow an attacker administrator level access to a device.

CVE Description

PowerLogic EGX100 and EGX300 Products have reached end of service and are no longer
supported. Customers should consider blocking HTTP access to the device at the firewall level
once commissioning is complete to reduce the risk of exposure. Additionally, Customers should
ensure the General security Recommendations listed below are in place.
Customers should also consider replacing the device with a supported product to resolve this
issue. Please contact your local Schneider Electric sales representative for upgrade options.

CVE-2021-22764

CVE Description

CVE-2021-22765

CWE-20: Improper Input Validation vulnerability exists that could cause denial of service or
remote code execution via a specially crafted HTTP packet.

CVE Description

CVE-2021-22766

CWE-20: Improper Input Validation vulnerability exists that could cause denial of service via a
specially crafted HTTP packet.

CVE Description

CVE-2021-22767

CVE Description

CVE-2021-22768

CVE Description


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

On June 8, 2021, Rockwell Automation disclosed multiple vulnerabilities in its ISaGRAF Workbench and ISaGRAF Runtime products. Multiple vendors, including Schneider Electric, embed ISaGRAF in their offers.
ISaGRAF Workbench is used to program applications for embedded devices using IEC 61131-3 languages and may be incorporated into larger programming and configuration tools. The ISaGRAF Runtime module executes the process control code created in ISaGRAF Workbench on embedded devices.
If successfully exploited, bad actors could execute a range of actions, including accessing and disclosing sensitive information, privilege escalation, and in some cases remote code execution.
Customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from possible exploitation of these vulnerabilities. Where appropriate, this includes locating their industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the mitigations and general security recommendations below.
For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center.
Subscribe to the Schneider Electric security notification service to be informed of critical
updates to this notification, including information on affected products and remediation plans:
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
November 2022 Update: Talus T4e and T4c RTUs were added as affected products along with a mitigation.
March 2023 Update: A remediation is available for SCD2200 product.

Overview

Summary: ISaGRAF Vulnerabilities - SEVD-2021-159-04 PDF Version

Summary: ISaGRAF Vulnerabilities - SEVD-2021-159-04 CSAF Version

ISaGRAF Vulnerabilities in IEC 61131-3 Programming and Engineering Tools

Summary: Original Release

Summary: Added remediations for SAGE RTU C3414 CPU, C3413 CPU and C3412 CPU

Summary: Added remediations for SCADAPack 300E RTU, SCADAPack 53xE RTU, and SCADAPack Workbench

Summary: A remediation is available for SCD2200 product (page 3).

Summary: New mitigations for the PowerLogic T300, MiCOM C264 D7.21 (or later) OR Easergy C5 1.1.6 (or later), PACiS GTW, and EPAS GTW are available for download.

Summary: New mitigations for Saitel DP and Saitel DR are available for download (page 5).

Summary: Corrected Versions for Easergy C5 & MiCOM C264 and Added CVSS Details for Related CVEs.

Schneider Electric

Talus T4c RTU

Schneider Electric Talus T4c RTU <A19.08

SCADAPack Workbench

Schneider Electric SCADAPack Workbench <6.6.8

SAGE RTU - C3414 CPU

Schneider Electric SAGE RTU - C3414 CPU <C3414-500-S02K5_P5

SAGE RTU - C3413 CPU C3412 CPU

Schneider Electric SAGE RTU - C3413 CPU C3412 CPU All Firmware Versions

SCADAPack Workbench

Schneider Electric SCADAPack Workbench 8.19.1

SAGE RTU - C3413 CPU C3412 CPU

Schneider Electric SAGE RTU - C3413 CPU C3412 CPU C3414-500-S02K5_P5

SAGE RTU - C3414 CPU

Schneider Electric SAGE RTU - C3414 CPU C3414-500-S02K5_P5

Rockwell Automation

ISaGRAF Runtime

Rockwell Automation ISaGRAF Runtime Versions 5.2 and prior default component of Schneider Electric Easergy C5 Versions up to 1.0.x

Rockwell Automation ISaGRAF Runtime Versions 5.2 and prior default component of Schneider Electric MiCOM C264 Versions up to D6.x

Some commands used by the Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x eXchange Layer (IXL) protocol perform various file operations in the file system. Since the parameter pointing to the file name is not checked for reserved characters, it is possible for a remote, unauthenticated attacker to traverse an application’s directory, which could lead to remote code execution.

CVE Description

New mitigations for the PowerLogic T300 are available for download. These mitigations reduce, but do not eliminate the risk of this vulnerability. Firmware v2.9.0 (or later) for the T300 is available for download here: https://www.se.com/ww/en/download/document/T300_Firmware/ If you cannot update to v2.9.0 (or later) please note the following. Customers should use the product firewall to block the TCP port 1131 and only unblock it during new program upgrade/debug.If ISaGRAF is not configured, the service is not active and the port is closed, then no further action is required.

ISaGRAF program upload/debug mode is disabled by default, after enabling for product commissioning, disable ISaGRAF program upload/debug mode. NOTE: New mitigations are available for this product. These mitigations reduce, but do not eliminate the risk of this vulnerability. Please contact your authorized service provider / customer care and request MiCOM C264 D7.21 (or later) OR Easergy C5 1.1.6 (or later).

If ISaGRAF is configured, customers should use the OS firewall to block TCP port 1131 and only unblock it during new program upgrade/debug.For detailed instructions, please contact your Schneider Electric representative and request “GTW ISaGRAF vulnerabilities mitigation plan.”NOTE: New mitigations are available for this product. These mitigations reduce, but do not eliminate the risk of this vulnerability. Please contact your authorized service provider / customer care and request EPAS Gateway v6.4.615.100.102 or later.

New mitigations for Saitel DP are available for download. These mitigations reduce, but do not eliminate the risk of this vulnerability. Firmware SM_CPU866e v11.06.32 (or later) for Saitel DP is available for download here: https://www.se.com/il/en/product-range/61747-saiteldp/#software-and-firmware If you cannot update to Firmware SM_CPU866e v11.06.32 (or later) please note the following. Customers should use the product firewall to block the TCP port 1131 and only unblock it during new program upgrade/debug. If ISaGRAF is not configured, the service is not active and the port is closed, then no further action is required.

New mitigations for Saitel DR are available for download. These mitigations reduce, but do not eliminate the risk of this vulnerability. Firmware HUe v11.06.27 (or later) for Saitel DR is available for download here: https://www.se.com/il/en/product-range/62685-saitel-dr-remoteterminal-unit-controller#software-and-firmware If you cannot update to Firmware HUe v11.06.27 (or later) please note the following. Customers should use the product firewall to block the TCP port 1131 and only unblock it during new program upgrade/debug. If ISaGRAF is not configured, the service is not active and the port is closed, then no further action is required.

Customers should upgrade to the firmware V9.1.0 or later (14942), which incorporates ISaGRAF Workbench V6.6.9. Notification of firmware release can be found here: https://secommunities.force.com/PAkb/s/article/CCN000244525 A reboot is required when upgrading to new firmware. No user actions are required to apply the remediation beyond upgrading the firmware in the RTU.

Implement firewall rules to restrict or block access on TCP port 1131 from outside the industrial control system.
Disable the ISaGRAF/TCP service when not required. Typically, this service is needed only during commissioning or maintenance operations.
Limit and control administrative access rights for ISaGRAF services.
Upgrade to ISaGRAF 6.6.9 (A19.09 Firmware or later).

V8.19.1 of SCADAPack Workbench includes a fix for these vulnerabilities and is available for download here:
https://shop.exchange.se.com/en-US/apps/62865/scadapack-e-workbench-and-utilities.
A reboot is required when upgrading to new firmware. No user actions are required to apply the remediation beyond upgrading the firmware in the RTU.
To verify the remediation is in place, use SCADAPack E Configurator or the RTU command line to display the firmware version.

Version C3414-500-S02K5_P5 of SAGE RTU CPU 3414 includes a fix for this vulnerability and is available for download here:
https://www.sage-rtu.com/downloads.html
Reboot of SAGE RTU is required after firmware upgrade.
This fix disables ISaGRAF by default and provides an additional network service checkbox to allow you to enable the ISaGRAF ETCP task, which will open listening ports to connect with ISaGRAF workbench when needed.
OR
If the firmware is not upgraded to C3414-500-S02K5_P5, but you are at firmware version C3414-500-S02K2 or above customers should immediately apply the following mitigations to reduce the risk of exploit:
If ISaGRAF is configured and in use, the built-in firewall can be used to disable ISaGRAF port 1131 and 1113 when the debugger is not in use. Use the following commands in the Firewall configuration to disable external access to ISaGRAF.
block in proto tcp from any to any port = 1131
block in proto tcp from any to any port = 1113
If ISaGRAF is NOT configured and in use, the ISaGRAF port is by default not enabled and does not start automatically, therefore there is no issue or required actions.

SAGE RTU CPU’s C3413 and C3412 have reached their end of life and are no longer supported. Customers should immediately upgrade to the latest CPU C3414 and apply C3414-500-S02K5_P5 or later firmware which can be downloaded here:
https://www.sage-rtu.com/downloads.html
Reboot of SAGE RTU is required after firmware upgrade.
This fix disables ISaGRAF by default and provides an additional network service checkbox to allow you to enable the ISaGRAF ETCP task, which will open listening ports to connect with ISaGRAF workbench when needed.

CVE-2020-25176

ISaGRAF Workbench communicates with Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x using TCP/IP. This communication protocol provides various file system operations, as well as the uploading of applications. Data is transferred over this protocol unencrypted, which could allow a remote unauthenticated attacker to upload, read, and delete files.

CVE Description

If ISaGRAF is configured, customers should upgrade to Saitel DP firmware 11.06.00 or higher and use the product firewall to block TCP port 1131 and only unblock it during new program upgrade/debug.
If ISaGRAF is not configured, the service is not active and the port is closed, then no further action is required.

If ISaGRAF is configured, customers should upgrade to Saitel DR firmware 11.06.03 or higher and use the product firewall to block the TCP port 1131 and only unblock it during new program upgrade/debug.
If ISaGRAF is not configured, the service is not active and the port is closed, then no further action is required.

CVE-2020-25178

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft Windows systems.

CVE Description

If ISaGRAF is configured, customers should upgrade to T300 firmware V1.4 or higher and use the product firewall to block the TCP port 1131 and only unblock it during new program upgrade/debug.
If ISaGRAF is not configured, the service is not active and the port is closed, then no further action is required.

For detailed instructions, please contact your Schneider Electric representative and request “C5 / C264 ISaGRAF vulnerabilities mitigation plan.”

If ISaGRAF is configured, customers should use the OS firewall to block TCP port 1131 and only unblock it during new program upgrade/debug.
For detailed instructions, please contact your Schneider Electric representative and request “GTW ISaGRAF vulnerabilities mitigation plan.”

CVE-2020-25182

CVE Description

CVE-2020-25184

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x includes the functionality of setting a password that is required to execute privileged commands. The password value passed to ISaGRAF Runtime is the result of encryption performed with a fixed key value using the tiny encryption algorithm (TEA) on an entered or saved password. A remote, unauthenticated attacker could pass their own encrypted password to the ISaGRAF 5 Runtime, which may result in information disclosure on the device.

CVE Description

CVE-2020-25180


Summary: Original Release

Summary: A release is available for EcoStruxure™ Control Expert v15.1 and EcoStruxure™ Process Expert 2021 that addresses workstation vulnerabilities related to the issues listed below. A subsequent release is planned to address the Modicon M580 and Modicon M340 PLC’s to complete the remediations.

Summary: A release is available for Modicon M340 controllers that addresses CVE-2021-22779, in conjunction with the latest release of EcoStruxure™ Control Expert. Subsequent firmware releases are planned to address the Modicon M580 PLC’s to complete the remediations that will fix CVE-2021-22779.

Summary: A release is available for SCADAPack RemoteConnect™ R2.7.3 that addresses workstation vulnerabilities related to the issues listed. (page 6) It has been determined that SCADAPack RemoteConnect™ versions prior to R2.7.3 are not affected by CVE-2021-22779, CVE-2021-22781, CVE-2021-22782.

Summary:
A fix is available for Modicon M580 V4.01 that addresses the vulnerabilities related to these issues.
Note that a complete remediation is a two-step process and will require an upgrade of the engineering software: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert or SCADAPack RemoteConnect™, in addition to an upgrade of the Modicon controller firmware: M340 and M580.
EcoStruxure™ Control Expert version 15.1 and EcoStruxure™ Process Expert V2021 include a fix for the vulnerabilities reported in this document and have been removed from the affected products list.

Summary: The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

Summary: A clarification was added to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 V4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document

Summary: The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities

Summary: A remediation is available for the Modicon M580 CPU Safety (page 9)

Summary: EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, SCADAPack RemoteConnect™ x70, and Modicon Controllers M580 and M340 - SEVD-2021-194-01_v5 CSAF Version

Summary: EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, SCADAPack RemoteConnect™ x70, and Modicon Controllers M580 and M340 - SEVD-2021-194-01_v5 PDF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert, SCADAPack RemoteConnect™ x70, and Modicon M580 and M340 control products. These vulnerabilities pose several risks, primary among these is the possibility of arbitrary code execution and loss of confidentiality and integrity of the project file.
With all products affected an attack would first involve an authenticated user gaining access to the engineering station; or an unauthenticated user gaining access to a project file or to the process control network.
Our findings demonstrate that while the discovered vulnerabilities affect Schneider Electric offers, it is possible to mitigate the potential impacts by following standard guidance, specific instructions; and in some cases, the fixes provided by Schneider Electric to remove the vulnerabilities.
Please ensure that if you are an EcoStruxure™ Control Expert user to apply the latest security updates provided below. For users of any of the mentioned products see the mitigation section in this security notice for further information on how to help protect your system from possible attack.
Schneider Electric encourages all industrial companies to ensure they have implemented cybersecurity best practices across their operations and supply chains to reduce cyber risks. Where appropriate this includes locating industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; systematically applying security patches.
March 2023 Update: Remediation for the Modicon M580 CPU is available for download (page 8).
We will update this document when the fixes are available. To ensure you are informed of the upcoming security notifications updates, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp
Note: A Proof-of-Concept script code that could potentially exploit some of these vulnerabilities has been discovered. Remediation and mitigation actions documented in this notification document will reduce the risk of exploit.

Overview

Schneider Electric

EcoStruxure™ Control Expert

Schneider Electric EcoStruxure™ Control Expert 15.1

EcoStruxure™ Control Expert

15.0 SP1

Schneider Electric EcoStruxure™ Control Expert 15.0 SP1

EcoStruxure™ Control Expert

<15.0 SP1

Schneider Electric EcoStruxure™ Control Expert versions prior to 15.0 SP1

EcoStruxure™ Process Expert

Schneider Electric EcoStruxure™ Process Expert 2021

Schneider Electric EcoStruxure™ Process Expert versions prior to 2021

SCADAPack RemoteConnect™ for x70

Schneider Electric SCADAPack RemoteConnect™ for x70 versions prior to R2.7.3

Schneider Electric SCADAPack RemoteConnect™ for x70 R2.7.3

Modicon M580 CPU

Schneider Electric Modicon M580 CPU, All versions

Modicon M340 CPU

Schneider Electric Modicon M340 CPU versions prior to 3.50

Schneider Electric Modicon M340 CPU 3.50

Modicon M580 CPU

Schneider Electric Modicon M580 CPU 4.02

Schneider Electric Modicon M580 CPU versions prior to SV4.10

Schneider Electric Modicon M580 CPU SV4.10

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions prior to SV4.21

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions SV4.21

CVE-2021-22779

A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.

CVE Description

EcoStruxure™ Control Expert V15.1*, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782, CVE-2020-12525, and CVE-2021-22779:
https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_V15.1/
* Upgrading to EcoStruxure™ Control Expert V15.1 is the first step in a two steps process to fully address CVE-2021-22779. The second step is to update the firmware of the Modicon Controllers referenced.
Important Note:
• The fix is provided through the additional feature “file encryption”, for further information on the feature and how to set it up please refers to the chapter “file encryption” of the help file available in the EcoStruxure™ Control Expert v15.0 SP1.
• This feature is proposed by default when creating a new project.
• This feature is also available, after selecting “project” in structural view, in the “Edit/ Properties/ Project & Controller Protection” menu.
• For new projects: Customers are recommended to apply this feature to all new projects.
• For existing projects: Customers are recommended to apply this feature to the existing projects coming from trusted source. For sta project files, as a reminder, project modification can be done in connected mode to prevent desynchronization and keep the controller in RUN state.
• It is possible to set a security level specific to the Derived Function Blocks (DFB) in addition to the file encryption feature. Please refer to the chapter "How to protect a DFB type" in the EcoStruxure™ Control Expert help file for further information.
• Customers are recommended to share project files only when configured with the encryption feature described above.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. These mitigations also reduce the risk of exploit for CVE-2021-22779 on all versions of EcoStruxure™ Control Expert, including V15.1:
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage
• Harden the workstation running EcoStruxure™ Control Expert or Unity Pro
Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert. Please contact your local Schneider Electric technical support for more information.

EcoStruxure™ Process Expert V2021, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782, and CVE-2020-12525:
https://www.se.com/myschneider/documentsDownloadCenterDetail/in/en/EPE2021Release
It is recommended to first review the ReadMe in its entirety before proceeding with the software installation.
*Upgrading to EcoStruxure™ Process Expert V2021 is the first step in a twosteps process to fully address CVE-2021-22779. To fully address this issue afirmware release will follow.
Important Note:
•Refer to the instructions provided for EcoStruxure™ Control Expert.
We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. These mitigations also reduce the risk of exploit for CVE-2021-22779 on all versions of EcoStruxure™ Process Expert
•Store the project files in a secure storage and restrict the access to onlytrusted users
•When exchanging files over the network, use secure communicationprotocols
•Encrypt project files when stored
•Only open project files received from trusted source
•Compute a hash of the project files and regularly check the consistency ofthis hash to verify the integrity before usage
•Harden the workstation running EcoStruxure™ Control Expert or Unity Pro
Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert. Please contact your local Schneider Electric technical support for more information.
•Harden the workstation running EcoStruxure™ Process Expert
To ensure you are informed of all security notifications updates, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

Firmware SV4.21 includes a fix for these vulnerabilities and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac-controller/#software-and-firmware
 Important: customer needs to use version of EcoStruxure™
Control Expert V16.0 HF001 minimum to connect with the latest
version of M580 CPU Safety. The software is available for
download here: tps://www.se.com/ww/en/product-range/548-ecostruxurecontrol-expert-unity-pro/#software-and-firmware

Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. For specific questions or support, Customers are requested to contact Schneider Electric’s Customer Care Center.
Modicon M580:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
• Setup a secure communication according to the following guideline “Modicon
Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 – BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/
• Setup a VPN between the Modicon PLC impacted modules and the engineering workstation containing EcoStruxure™ Control Expert or Process Expert.
• Ensure the CPU is running with the memory protection activated by configuring the input bit to a physical input , for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication

If customers choose not to apply the remediation then they are encouraged
to immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
• Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 – BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/
• Setup a VPN between the Modicon PLC impacted modules and the engineering workstation containing EcoStruxure™ Control Expert or Process Expert.
To further reduce the attack surface on Modicon M580 CPU Safety:
• Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

Firmware SV4.10 includes a fix for CVE-2021-22779 vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/
If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit::
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
• Setup a secure communication according to the following guideline “Modicon
Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 – BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/
• Setup a VPN between the Modicon PLC impacted modules and the engineering workstation containing EcoStruxure™ Control Expert or Process Expert.
• Ensure the CPU is running with the memory protection activated by configuring the input bit to a physical input , for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication

CVE-2021-22778

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause protected derived function blocks to be read or modified by unauthorized users when accessing a project file.

CVE Description

EcoStruxure™ Control Expert V15.1*, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782, CVE-2020-12525:
https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_V15.1/
*Upgrading to EcoStruxure™ Control Expert V15.1 is the first step in a two stepsprocess to fully address CVE-2021-22779. To fully address this issue a firmwarerelease will follow.
Important Note:
•The fix is provided through the additional feature “file encryption”, forfurther information on the feature and how to set it up please refers to thechapter “file encryption” of the help file available in the EcoStruxure™Control Expert v15.0 SP1.
•This feature is proposed by default when creating a new project.
•This feature is also available, after selecting “project” in structural view, inthe “Edit/ Properties/ Project & Controller Protection” menu.
•For new projects:
oCustomers are recommended to apply this feature to all newprojects.
•For existing projects:
oCustomers are recommended to apply this feature to the existingprojects coming from trusted source. For .sta project files, as areminder, project modification can be done in connected mode toprevent desynchronization and keep the controller in RUN state.
•It is possible to set a security level specific to the Derived Function Blocks(DFB) in addition to the file encryption feature. Please refer to the chapter"How to protect a DFB type" in the EcoStruxure™ Control Expert help filefor further information.
•Customers are recommended to share project files only when configuredwith the encryption feature described above.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. These mitigations also reduce the risk of exploit for CVE-2021-22779 on all versions of EcoStruxure™ Control Expert, including V15.1:
•Store the project files in a secure storage and restrict the access to onlytrusted users
•When exchanging files over the network, use secure communicationprotocols
•Encrypt project files when stored
•Only open project files received from trusted source
•Compute a hash of the project files and regularly check the consistency ofthis hash to verify the integrity before usage.
•Harden the workstation running EcoStruxure™ Control Expert or Unity Pro
Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert. Please contact your local Schneider Electric technical support for more information.

EcoStruxure™ Process Expert V2021*, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782, and CVE-2020-12525:
https://www.se.com/myschneider/documentsDownloadCenterDetail/in/en/EPE2021Release
It is recommended to first review the ReadMe in its entirety before proceeding with the software installation.
*Upgrading to EcoStruxure™ Process Expert V2021 is the first step in a twosteps process to fully address CVE-2021-22779. To fully address this issue afirmware release will follow.
Important Note:
•Refer to the instructions provided for EcoStruxure™ Control Expert.
We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. These mitigations also reduce the risk of exploit for CVE-2021-22779 on all versions of EcoStruxure™ Process Expert
•Store the project files in a secure storage and restrict the access to onlytrusted users
•When exchanging files over the network, use secure communicationprotocols
•Encrypt project files when stored
•Only open project files received from trusted source
•Compute a hash of the project files and regularly check the consistency ofthis hash to verify the integrity before usage.
•Harden the workstation running EcoStruxure™ Control Expert or Unity Pro
Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert. Please contact your local Schneider Electric technical support for more information.
•Harden the workstation running EcoStruxure™ Process Expert
To ensure you are informed of all security notifications updates, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

Version R2.7.3 of SCADAPack RemoteConnect™, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, and CVE-2020-12525:
RemoteConnect for the SCADAPack x70 | Schneider Electric Exchange Marketplace (se.com)
Important Note:
•Refer to the instructions provided for EcoStruxure™ Control Expert.
We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure.
Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
Note: Users no longer need to update the RemoteConnect™ application when there is a Control Expert update
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
•Store the project files in a secure storage and restrict the access to onlytrusted users
•When exchanging files over the network, use secure communicationprotocols
•Encrypt project files when stored
•Only open project files received from trusted source
•Compute a hash of the project files and regularly check the consistency ofthis hash to verify the integrity before usage.
•Harden the workstation running EcoStruxure™ Control Expert or Unity Pro
Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert. Please contact your local Schneider Electric technical support for more information.
•Harden the workstation running SCADAPack RemoteConnect™

CVE-2020-12525

M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage.
Note: This vulnerability could cause local code execution on the engineering workstation when a malicious project file is loaded into the engineering software.

CVE Description

EcoStruxure™ Control Expert V15.1, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782, CVE-2020-12525:
https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_V15.1/
*Upgrading to EcoStruxure™ Control Expert V15.1 is the first step in a two stepsprocess to fully address CVE-2021-22779. To fully address this issue a firmwarerelease will follow.
Important Note:
•The fix is provided through the additional feature “file encryption”, forfurther information on the feature and how to set it up please refers to thechapter “file encryption” of the help file available in the EcoStruxure™Control Expert v15.0 SP1.
•This feature is proposed by default when creating a new project.
•This feature is also available, after selecting “project” in structural view, inthe “Edit/ Properties/ Project & Controller Protection” menu.
•For new projects:
oCustomers are recommended to apply this feature to all newprojects.
•For existing projects:
oCustomers are recommended to apply this feature to the existingprojects coming from trusted source. For .sta project files, as areminder, project modification can be done in connected mode toprevent desynchronization and keep the controller in RUN state.
•It is possible to set a security level specific to the Derived Function Blocks(DFB) in addition to the file encryption feature. Please refer to the chapter"How to protect a DFB type" in the EcoStruxure™ Control Expert help filefor further information.
•Customers are recommended to share project files only when configuredwith the encryption feature described above.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. These mitigations also reduce the risk of exploit for CVE-2021-22779 on all versions of EcoStruxure™ Control Expert, including V15.1:
•Store the project files in a secure storage and restrict the access to onlytrusted users
•When exchanging files over the network, use secure communicationprotocols
•Encrypt project files when stored
•Only open project files received from trusted source
•Compute a hash of the project files and regularly check the consistency ofthis hash to verify the integrity before usage.
•Harden the workstation running EcoStruxure™ Control Expert or Unity Pro
Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert. Please contact your local Schneider Electric technical support for more information.

EcoStruxure™ Process Expert V2021, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782, and CVE-2020-12525:
https://www.se.com/myschneider/documentsDownloadCenterDetail/in/en/EPE2021Release
It is recommended to first review the ReadMe in its entirety before proceeding with the software installation.
*Upgrading to EcoStruxure™ Process Expert V2021 is the first step in a twosteps process to fully address CVE-2021-22779. To fully address this issue afirmware release will follow.
Important Note:
•Refer to the instructions provided for EcoStruxure™ Control Expert.
We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. These mitigations also reduce the risk of exploit for CVE-2021-22779 on all versions of EcoStruxure™ Process Expert
•Store the project files in a secure storage and restrict the access to onlytrusted users
•When exchanging files over the network, use secure communicationprotocols
•Encrypt project files when stored
•Only open project files received from trusted source
•Compute a hash of the project files and regularly check the consistency ofthis hash to verify the integrity before usage.
•Harden the workstation running EcoStruxure™ Control Expert or Unity Pro
Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert. Please contact your local Schneider Electric technical support for more information.
•Harden the workstation running EcoStruxure™ Process Expert
To ensure you are informed of all security notifications updates, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2021-22780

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause unauthorized access to a project file protected by a password when this file is shared with untrusted sources. An attacker may bypass the password protection and be able to view and modify a project file.

CVE Description

CVE-2021-22781

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause a leak of SMTP credential used for mailbox authentication when an attacker can access a project file.

CVE Description

Codesafe Team of Legendsec at Qi'anxin Group

EcoStruxure™ Process Expert V2021*, available for download below, includes a fix for CVE-2021-22778, CVE-2021-22780, CVE-2021-22781, CVE-2021-22782, CVE-2020-12525, and CVE-2021-22779:
https://www.se.com/myschneider/documentsDownloadCenterDetail/in/en/EPE2021Release
It is recommended to first review the ReadMe in its entirety before proceeding with the software installation.
* Upgrading to EcoStruxure™ Process Expert V2021 is the first step in a two steps process to fully address CVE-2021-22779. The second step is to update the firmware of the Modicon Controllers referenced.
Important Note:
• Refer to the instructions provided for EcoStruxure™ Control Expert.
We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit. These mitigations also reduce the risk of exploit for CVE-2021-22779 on all versions of EcoStruxure™ Process Expert:
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage
• Harden the workstation running EcoStruxure™ Process Expert
To ensure you are informed of all security notifications updates, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2021-22782

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could cause an information leak allowing disclosure of network and process information, credentials, or intellectual property when an attacker can access a project file.

CVE Description


SoSafe Configurable

Summary: Original Release

Summary: SoSafe Configurable - SEVD-2021-194-03 PDF Version

Summary: SoSafe Configurable - SEVD-2021-194-03 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its SoSafe Configurable product. The SoSafe Configurable product is used to configure Preventa safety controllers. Failure to apply the remediations provided below may risk code execution on the engineering workstation by opening a malicious project file.

Overview

Schneider Electric

SoSafe Configurable

Schneider Electric SoSafe Configurable prior to V1.8.1

Schneider Electric SoSafe Configurable 1.8.1

CVE-2021-22777

A CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause code
execution by opening a malicious project file.

CVE Description

V1.8.1 of the SoSafe Configurable product includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/SoSafe_Configurable/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
•Configure the access control on the engineering workstation where the software isinstalled
•Only allow authorized people to authenticate on the engineering workstation
•Configure and enable the firewall to prevent any unauthorized communication with theengineering workstation
• Ensure Antivirus or any other endpoint protections are installed on the engineering workstation and up to date.


C-Bus Toolkit

Summary: Original Release

Summary: C-Bus Toolkit - SEVD-2021-194-04 PDF Version

Summary: C-Bus Toolkit - SEVD-2021-194-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its C-Bus Toolkit product.
The C-Bus Toolkit product is an application you run on your personal computer to configure and commission C-Bus Installations.
Failure to apply the remediations provided below may risk a remote code execution attack, which could result in an attacker having remote access to the computer.

Overview

Schneider Electric

C-Bus Toolkit

Schneider Electric C-Bus Toolkit v1.15.8 and prior

CVE-2021-22784

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow an attacker to use a crafted webpage to obtain remote access to the system.

CVE Description

Version 1.15.9 of the C-Bus Toolkit product includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/2216-spacelogic-c-bus-home-automation-system/?parent-subcategory-id=88010&filter=business-5-residential-and-small-business#software-and-firmware
Note: A reboot will be needed after the update.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Use an allow list for this this application
• Turn on the computer’s firewall
• Use an antivirus program
• Secure the computer to prevent unauthorized personnel from accessing the computer


Easergy T200

Summary: Original Release

Summary: Easergy T200 - SEVD-2021-194-05 PDF Version

Summary: Easergy T200 - SEVD-2021-194-05 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Easergy T200 RTU (Remote Terminal Unit).
The Easergy T200 RTU is a modular platform for medium voltage and low voltage public
distribution network management.
Failure to apply the mitigations provided below may allow authentication bypass during control
command.

Overview

The communication board is impacted by this vulnerability and is the same for all T200 models (T200I/T200E, T200P). The corresponding firmware depends on the protocol used.

Affected Products and Versions

Schneider Electric

Easergy T200 (Modbus)

Schneider Electric Easergy T200 (Modbus) SC2-04MOD-07000100 and earlier

Easergy T200 (IEC104)

Schneider Electric Easergy T200 (IEC104) SC2-04IEC-07000100 and earlier

Easergy T200 (DNP3)

Schneider Electric Easergy T200 (DNP3) SC2-04DNP-07000102 and earlier

Easergy T200 (Modbus)

Schneider Electric Easergy T200 (Modbus) SC2-04MOD-07000103

Easergy T200 (IEC104)

Schneider Electric Easergy T200 (IEC104) SC2-04IEC-07000103

Easergy T200 (DNP3)

Schneider Electric Easergy T200 (DNP3) SC2-04DNP-07000103

CVE-2021-22772

CWE-306: Missing Authentication for Critical Function vulnerability exists that could
cause unauthorized operation when authentication is bypassed.

CVE Description

Customers are strongly encouraged to upgrade to version
SC2-04MOD-07000103 available from the Schneider
Electric Customer Care Center.

Customers are strongly encouraged to upgrade to version
SC2-04IEC-07000103 available from the Schneider Electric
Customer Care Center.

Customers are strongly encouraged to upgrade to version
SC2-04DNP-07000103 available from the Schneider
Electric Customer Care Center.

We also recommend using strong passwords and apply the following rules: • Change the default passwords the first time you connect to the product • Renew passwords with reasonable frequency • Do not store passwords in a file on a computer station that is particularly exposed to risk • Passwords should be at least 8 characters long and of different types (upper case, lower case, numbers, special characters)


Summary: Original Release

Summary: Added Altivar Profinet Communication Module (VW3A3627), Lexium Ethernet TCP/IP Communication Module (VW3A3616), and Altivar Profinet - Communication Card (VW3A3327) to the list of affected products.

Summary: A remediation is available for Lexium ILE, ILA, ILS drives and the affected communication module firmware version has been updated.

Summary: A remediation is available for Altivar 32/320 & Lexium 32 Ethernet TCP/IP communication module (VW3A3616)

Summary: NicheStack TCP/IP Vulnerabilities (INFRA:HALT) in Lexium ILE, ILA, ILS, and Communication Option Boards for Altivar and Lexium32 drives - SEVD-2021-217-01 PDF Version

Summary: NicheStack TCP/IP Vulnerabilities (INFRA:HALT) in Lexium ILE, ILA, ILS, and Communication Option Boards for Altivar and Lexium32 drives - SEVD-2021-217-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in HCC Embedded’s NicheStack TCP/IP third party component, which is integrated into Schneider Electric’s Lexium ILE, ILA, ILS, Altivar Profinet Communication Module (VW3A3627), Altivar and Lexium Ethernet TCP/IP Communication Module (VW3A3616), and Altivar Profinet - Communication Card (VW3A3327) products.
Failure to apply the mitigations provided below may risk denial of service of the drives.
February 2023 Update: A remediation is available for Altivar 32/320/340/600/900 Profinet communication module (VW3A3627)

Overview

Schneider Electric

Lexium ILE ILA ILS communication drive

Schneider Electric Lexium ILE ILA ILS communication drive version 01.110 and prior

Schneider Electric Lexium ILE ILA ILS communication drive 01.111

Schneider Electric Altivar 32/320/340/600/900 Profinet communication module (VW3A3627)

Schneider Electric Altivar 32/320 and Lexium 32 Ethernet TCP/IP communication module (VW3A3616) versions prior to V1.20IE01

Schneider Electric Altivar 61/71 Profinet communication card (VW3A3327) All versions

CVE-2021-31400

Five of the 14 vulnerabilities disclosed by researchers in the NicheStack TCP/IP component impact Schneider Electric’s Lexium ILE, ILA, ILS, Altivar Profinet Communication Module (VW3A3627), Altivar and Lexium Ethernet TCP/IP Communication Module (VW3A3616), and Altivar Profinet - Communication Card (VW3A3327). Additional information vulnerability details can be found at https://us-cert.cisa.gov/ics/advisories/icsa-21-217-01.

CVE Description

V01.111 of Lexium ILE, ILA, ILS communication module includes a fix for these vulnerabilities.
Reboot is needed.
Please contact your local Schneider Electric technical support for more information on how to get the firmware and how to upgrade the communication firmware module.

Schneider Electric is establishing a remediation plan for all future versions of Altivar and Lexium Ethernet TCP/IP Communication Module (VW3A3616). We will update this document when the remediation or additional mitigations are available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:
• Implement a firewall to restrict network access to the drives
• Configure the controller associated to the drives by disabling IP forwarding as described in the online help of your controller.
• Configure the controller with dedicated access control lists as described below
More information to implement these mitigations can be found in the online help of the controllers at:
https://olh.schneider-electric.com/Machine Expert/V2.0/LandingPages/en/index.html
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

V1.10.1 of Altivar 32/320/340/600/900 Profinet communication module includes a fix for these vulnerabilities.
For product release prior to V1.10.1, apply the mitigations detailed in the Mitigations section and contact your local technical support for more information.

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Mitigations section.

CVE-2021-31401

CVE Description

Schneider Electric is establishing a remediation plan for all future versions of Altivar Profinet Communication Module (VW3A3627), Altivar and Lexium Ethernet TCP/IP Communication Module (VW3A3616), and Altivar Profinet - Communication Card (VW3A3327) products. We will update this document when the remediation or additional mitigations are available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:
• Implement a firewall to restrict network access to the drives
• Configure the controller associated to the drives by disabling IP forwarding as described in the online help of your controller.
• Configure the controller with dedicated access control lists as described below
More information to implement these mitigations can be found in the online help of the controllers at:
https://olh.schneider-electric.com/Machine Expert/V2.0/LandingPages/en/index.html
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

V1.20IE01 of Altivar 32/320 and Lexium 32 Ethernet TCP/IP communication module includes a fix for these vulnerabilities. For product release prior to V1.20IE01, apply the mitigations detailed in the Mitigations section and contact your local technical support for more information

CVE-2020-35683

CVE Description

CVE-2020-35685

CVE Description

CVE-2020-35684

CVE Description


Summary: Original Release

Summary: Remediation update

Summary: Recently released versions of EcoStruxure™ Control Expert and EcoStruxure™ Process Expert previously communicated to address these vulnerabilities were found to not fully address the issues as stated in a previous update of this notification. Customers are encouraged to follow the mitigations provided below.

Summary: Added remediation for EcoStruxure™ Control Expert V15.1 HF001 and EcoStruxure™ Process Expert V2021. Schneider Electric is establishing a remediation plan for future versions of SCADAPack RemoteConnect for x70. Added CVE-2022-26507.

Summary: Added remediation for SCADAPack RemoteConnect™ for x70.

Summary: AT&T Labs Compressor (XMilI) and Decompressor (XDemill) used by EcoStruxureTM Control Expert, EcoStruxureTM Process Expert and SCADAPack RemoteConnect™ for x70 - SEVD-2021-222-02 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities on AT&T Labs’ Compressor (XMilI) and decompressor (XDemill) third party components used by EcoStruxure Control Expert, EcoStruxure Process Expert and SCADAPack RemoteConnect™ for x70.
Failure to apply the mitigations provided below may lead to the execution of a malicious file, which could result in code execution with elevated privileges on the engineering workstation. For an attack to be successful, an attacker requires access to the engineering workstation and then needs to trick a valid user to run a script or load a malicious project file.
July 2022 Update: A release is available for SCADAPack RemoteConnect™ R2.7.3 that addresses workstation vulnerabilities related to the issues listed below.

Overview

Schneider Electric

EcoStruxure™ Control Expert

<15.1 HF001

Schneider Electric EcoStruxure™ Control Expert <15.1 HF001

EcoStruxure™ Control Expert

15.1 HF001

Schneider Electric EcoStruxure™ Control Expert 15.1 HF001

EcoStruxure™ Process Expert

Schneider Electric EcoStruxure™ Process Expert <2021

Schneider Electric EcoStruxure™ Process Expert 2021

SCADAPack RemoteConnect™ for x70

Schneider Electric SCADAPack RemoteConnect™ for x70 <R2.7.3

Schneider Electric SCADAPack RemoteConnect™ for x70 R2.7.3

CVE-2021-21810

V15.1 HF001 of EcoStruxure™ Control Expert includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/ControlExpert_V151_HF001/
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication channels
• Only open project files received from a trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage
• Harden the workstation running EcoStruxure Control Expert or Unity Pro
• Customers using Unity Pro should strongly consider migrating to EcoStruxure Control Expert.

V2021 of EcoStruxure™ Process Expert includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/myschneider/documentsDownloadCenterDetail/in/en/EPE2021Release
It is recommended to first read the ReadMe first document before proceeding with the software installation.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication channels
• Only open project files received from a trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage
• Harden the workstation running EcoStruxure Process Expert

Version R2.7.3 of SCADAPack RemoteConnect™ includes a fix for these vulnerabilities and is available for download here at the Schneider Electric Exchange:
https://shop.exchange.se.com/en-US/apps/58663
Note: Users no longer need to update the RemoteConnect™ application when there is a Control Expert update.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
•Store the project files in a secure storage and restrict theaccess to only trusted users
•When exchanging files over the network, use securecommunication channels
•Only open project files received from a trusted source
•Compute a hash of the project files and regularly check theconsistency of this hash to verify the integrity before usage
•Harden the workstation running SCADAPackRemoteConnect™ for x70

The vulnerabilities reported on XDemill and XMilI are triggered through the execution of a malicious script on the engineering workstation, or when loading a specially crafted project file into the engineering tool. The successful exploitation of these vulnerabilities may lead to code execution with elevated privileges on the engineering workstation.

CVE-2021-21825

CVE-2021-21811

CVE-2021-21826

CVE-2021-21812

CVE-2021-21827

CVE-2021-21813

CVE-2021-21828

CVE-2021-21814

CVE-2021-21829

CVE-2021-21815

CVE-2021-21830

CVE-2022-26507


Pro-face GP-Pro EX

Summary: Original Release

Summary: Pro-face GP-Pro EX - SEVD-2021-222-03 PDF Version

Summary: Pro-face GP-Pro EX - SEVD-2021-222-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Pro-face GP-Pro EX product.
The Pro-face GP-Pro EX product is an HMI Screen Editor & Logic Programming Software.
Failure to apply the remediations provided below may risk software hijacking, which could result in code execution with elevated privileges during software install.

Overview

Schneider Electric

GP-Pro EX

Schneider Electric GP-Pro EX V4.09.250 and prior

CVE-2021-22775

A CWE-427: Uncontrolled Search Path Element vulnerability exists that could cause local code execution with elevated privileges when installing the software.

CVE Description

V4.09.300 of the Pro-face GP-Pro EX product includes a fix for this vulnerability and is available for download here:
https://www.proface.com/en/download/trial/gpproex/v40

In addition to the remediation provided above, customers should also apply the following mitigations to reduce the risk of exploit:
•Restrict access to the system to only authorized users
•Ensure that proper access rights are granted based on the least privilege principle tolimit access to the installation files to only authorized users.
•Compute a hash of the GP-Pro EX ISO files downloaded and check the consistency ofthis hash with the one available at the download location on Pro-face website.

In addition to the remediation provided above, customers should also apply the following mitigations to reduce the risk of exploit: • Restrict access to the system to only authorized users • Ensure that proper access rights are granted based on the least privilege principle to limit access to the installation files to only authorized users. • Compute a hash of the GP-Pro EX ISO files downloaded and check the consistency of this hash with the one available at the download location on Pro-face website.


Summary: Original Release

Summary: A fix is available for Modicon M340 and Modicon M580 that addresses these vulnerabilities.

Summary: The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

Summary: A clarification added to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 V4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document

Summary: The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

Summary: A remediation is available for Modicon MC80

Summary: A remediation is available for Modicon M580 CPU Safety (page 3).

Summary: Modicon PAC Controllers and PLC Simulator for EcoStruxure™ Control Expert and EcoStruxure™ Process Expert - SEVD-2021-222-04 PDF Version

Summary: Modicon PAC Controllers and PLC Simulator for EcoStruxure™ Control Expert and EcoStruxure™ Process Expert - SEVD-2021-222-04 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Modicon PAC Controllers and PLC simulator included in EcoStruxure™ Control Expert and EcoStruxure™ Process Expert.
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient and protected way.
The PLC Simulator feature is part of the EcoStruxure™ Control Expert and EcoStruxure™ Process Expert software and it helps users to review and test their configurations files in a simulation environment and is not intended to be used as a controller CPU in a production environment.
Failure to apply the mitigations provided below may lead to the execution of a malicious project file, which could result in loss of availability of the controller or of the PLC simulator. For an attack to be successful, a malicious project file must be downloaded in the controller or in the simulator.
March 2023 Update: A remediation is available for Modicon M580 CPU and Modicon Momentum Unity M1E Processor for CVE-2021-22789 , and update to the PLC Simulator user manual to reflect the mitigation

Overview

Schneider Electric

Modicon M580 CPU

Schneider Electric Modicon M580 CPU <SV4.10

Schneider Electric Modicon M580 CPU SV4.10

Modicon M580 CPU Safety

< SV4.21

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions prior to SV4.21

Modicon M340 CPU

Schneider Electric Modicon M340 CPU <3.50

Schneider Electric Modicon M340 CPU 3.50

Modicon Momentum Unity M1E Processor (part numbers 171CBU*) <SV2.6

Schneider Electric Modicon Momentum CPU All versions <SV2.6

Schneider Electric Modicon Momentum Unity M1E Processor (part numbers 171CBU*) Modicon Momentum Unity M1E Processor (part numbers 171CBU*) SV2.6

All versions

Schneider Electric PLC Simulator for EcoStruxure™ Control Expert All versions

Schneider Electric PLC Simulator for EcoStruxure™ Process Expert All versions

Legacy Modicon Premium and Quantum

Schneider Electric Legacy Modicon Premium and Quantum All versions

Modicon Premium CPU

All versions

Schneider Electric Modicon Premium CPU  All versions

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions SV4.21

CVE-2021-22789

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file.

CVE Description

Codesafe Team of Legendsec at Qi’anxin Group

M340 V3.50 includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/

Firmware SV1.90 includes a fix for CVE-2021-22789 vulnerability and is available for download here:

Firmware SV4.21 includes a fix for these vulnerabilities and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac-controller/#software-and-firmware
 Important: customer needs to use version of EcoStruxure™
Control Expert V16.0 HF001 minimum to connect with the latest
version of M580 CPU Safety. The software is available for
download here: tps://www.se.com/ww/en/product-range/548-ecostruxurecontrol-expert-unity-pro/#software-and-firmware

Schneider Electric’s Modicon Premium and Quantum controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our current product offer.
Customers should strongly consider migrating to the Modicon M580 ePAC.
Please contact your local Schneider Electric technical support for more information.

Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Download and setup EcoStruxure Control Expert V15.0 SP1 from this link: https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_15SP1
o Use the new “file encryption” feature available on EcoStruxure Control Expert v15.0 SP1 in order to protect the project files.
o Ensure to use simulator default panel option to make PLC simulator accessible only locally.
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage
• Harden the workstation running EcoStruxure Control Expert or Unity Pro
Note: The PLC Simulator feature is part of the EcoStruxure Control Expert and EcoStruxure Process Expert software, and it helps users to review and test their configurations files in a simulation environment. It is not intended to be used as a controller CPU in a production environment.
Update: Refer to the PLC Simulator user manual for more details on enforcing security settings available here.
https://www.se.com/ww/en/download/document/EIO0000001714/

Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage
• Harden the workstation running EcoStruxure Control Expert or Unity Pro
Note: The PLC Simulator feature is part of the EcoStruxure Control Expert and EcoStruxure Process Expert software, and it helps users to review and test their configurations files in a simulation environment. It is not intended to be used as a controller CPU in a production environment.

Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer.
Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.
To mitigate the risks users should immediately:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP Services Configuration Parameters / Connection Configuration Parameters”: https://www.se.com/ww/en/download/document/35006192K01000/

• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
o “Modicon M580, Hardware, Reference Manual” https://www.se.com/ww/en/download/document/EIO0000001578/
o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
o “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000002071.02.pdf&p_Doc_Ref=EIO0000002071
o “Momentum for EcoStruxure™ Control Expert - 171 CBU 78090, 171 CBU 98090, 171 CBU 98091 Processors” manual in the chapter “Modbus Messaging and Access Control” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=HRB44124.08.pdf&p_Doc_Ref=HRB44124
o Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
• Setup a VPN between the Modicon PLC controller and the engineering workstation containing EcoStruxure Control Expert or Process Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp
Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer.
Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.
To mitigate the risks users should immediately:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
Configure the Access Control List following the recommendations of the user manual “Premium and Atrium using EcoStruxure™ Control Expert – Ethernet Network Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP Services Configuration Parameters / Connection Configuration Parameters”: https://www.se.com/ww/en/download/document/35006192K01000/

Modicon M580 SV4.10 includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/

Firmware V2.6 includes a fix for CVE-2021-22789 vulnerability and is available for download here: https://www.se.com/ww/en/download/document/Momentum_FW_update/

CVE-2021-22790

A CWE-125: Out-of-bounds Read vulnerability exists that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file.

CVE Description

Schneider Electric is establishing a remediation plan for all future versions of Modicon MC80 and Modicon Momentum MDI that will include a fix for these vulnerabilities. We will update this document when the remediation is available.

• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
o “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
o “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000002071.02.pdf&p_Doc_Ref=EIO0000002071
o “Momentum for EcoStruxure™ Control Expert - 171 CBU 78090, 171 CBU 98090, 171 CBU 98091 Processors” manual in the chapter “Modbus Messaging and Access Control” https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=HRB44124.08.pdf&p_Doc_Ref=HRB44124
• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
• Ensure the M580 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
 NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication
• Setup a VPN between the Modicon PLC controller and the engineering workstation containing EcoStruxure Control Expert or Process Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.
To further reduce the attack surface on Modicon M580 CPU Safety:
o Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”
https://www.se.com/ww/en/download/document/QGH60283/
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2021-22791

A CWE-787: Out-of-bounds Write vulnerability exists that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file.

CVE Description

CVE-2021-22792

A CWE-476: NULL Pointer Dereference vulnerability exists that could cause a Denial of Service on the Modicon PLC controller / simulator when updating the controller application with a specially crafted project file.

CVE Description


AccuSine PCSn/PCS+/PFV+

Summary: Original Release

Summary: AccuSine PCSn/PCS+/PFV+ - SEVD-2021-222-05 PDF Version

Summary: AccuSine PCSn/PCS+/PFV+ - SEVD-2021-222-05 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its AccuSine PCSn, PCS+ and PFV+ products.
AccuSine addresses power quality issues and stabilizes electrical networks by providing harmonic mitigation, power factor correction, and load balancing.
Failure to apply the remediations provided below may risk an authenticated attacker being able to access the device via an unused FTP service, which could result in unexpected device behavior, or device failure.

Overview

Schneider Electric

AccuSine PCS+

Schneider Electric AccuSine PCS+ Versions prior to V1.6.7

AccuSine PFV+

Schneider Electric AccuSine PFV+ Versions prior to V1.6.7

AccuSine PCSn

Schneider Electric AccuSine PCSn Versions prior to V2.2.4

CVE-2021-22793

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an authenticated attacker to access the device via FTP protocol.

CVE Description

V1.6.7 of the AccuSine PCS+ / PFV+ product includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/AccuSine_PCSP_PFVP_Firmware/
This fix disables the FTP server, which is not necessary for product operation.
Customers should also ensure that the administrative password for their device has been changed from the default value as instructed in the user manual.

2.2.4 of the AccuSine PCSn product includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/AccuSine_PCSn_firmware_update/
This fix disables the FTP server, which is not necessary for product operation.
Customers should also ensure that the administrative password for their device has been changed from the default value as instructed in the user manual.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
Ensure that the FTP service on the device is not accessible beyond the local network through router configurations. Customers should also ensure that the administrative password for their device has been changed from the default value.