Summary: Original Release

Summary: Schneider Electric Software Update (SESU) - SEVD-2020-196-01 PDF Version

Summary: Schneider Electric Software Update (SESU) - SEVD-2020-196-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Schneider Electric Software Update (SESU)
product.

Overview

Schneider Electric Schneider Electric Software Update (SESU) V2.4.0 and prior

Schneider Electric Schneider Electric Software Update (SESU) V2.5.0

CVE-2020-7520

A CWE-601: URL Redirection to Untrusted Site ('Open Redirect') vulnerability exists which
could cause execution of malicious code on the victim´s machine. In order to exploit this
vulnerability, an attacker requires privileged access on the engineering workstation to modify a
Windows registry key which would divert all traffic updates to go through a server in the
attacker’s possession. A man-in-the-middle attack is then used to complete the exploit.

CVE Description

This vulnerability is fixed in version 2.5.0 and is available for download below:
https://www.seupdate.schneiderelectric.com/download/SystemConsistency/SoftwareUpdate/SESU_250/SESU_2.5.0_setup_sfx.
exe
If you have already installed SESU, it will show that a new critical update is available for
installation. To install the security update, download and execute the setup file.


Schneider Electric Modbus Serial Driver

Summary: Original Release

Summary:
-Added Remediation note for EcoStruxure
 Machine Expert Basic
-Minor formatting changes

Summary: Schneider Electric Modbus Serial Driver - SEVD-2020-224-01 PDF Version

Summary: Schneider Electric Modbus Serial Driver - SEVD-2020-224-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Modbus Serial Driver Component.

Overview

Schneider Electric

<V3.20 IE 30

Schneider Electric Schneider Electric Modbus Serial Driver (64 bits) versions prior to V3.20 IE 30

<V2.20 IE 30

Schneider Electric Schneider Electric Modbus Serial Driver (32 bits) versions prior to V2.20 IE 30

Schneider Electric Modbus Driver Suite

Schneider Electric Schneider Electric Modbus Driver Suite versions prior to V14.15.0.0

Schneider Electric Schneider Electric Modbus Driver Suite V14.15.0.0

CVE-2020-7523

A CWE-269: Improper Privilege Management vulnerability exists which could cause local
privilege escalation when the Modbus Serial Driver service is invoked. The driver does not
properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of
control for that actor.

CVE Description

This vulnerability is fixed in Schneider Electric Modbus Driver Suite version V14.15.0.0 and is
available for download below:
https://www.se.com/ww/en/download/document/MSCD_V14.15.0.0/
The Schneider Electric Modbus Driver Suite is an independent software component which will
fix this vulnerability in all affected products.
Please download install package and release notes and execute the Setup file.
The following mitigations can be applied by customers to reduce the risk:
- Follow workstation, network, and site-hardening guidelines in the Cybersecurity Best
Practices guide available for download here.
Note: For EcoStruxure Power Commission, the updated Modbus Serial Driver is included in
V6.0 and is available for download below:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/
Note: For EcoStruxure Machine Expert Basic, the updated Modbus Serial Driver is included in
V1.1 and is available for download below:
https://www.seupdate.schneider-electric.com/download/MachineExpertBasic/MachineExpertBasicV1.1.0/MachineExpertBasic_V1.1_build64712.exe


Summary: Original Release

Summary: spaceLYnk & Wiser for KNX (formerly homeLYnk) - SEVD-2020-224-02 PDF Version

Summary: spaceLYnk & Wiser for KNX (formerly homeLYnk) - SEVD-2020-224-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the spaceLYnk and Wiser for KNX (formerly
known as homeLYnk) products.

Overview

Schneider Electric

spaceLYnk

Schneider Electric spaceLYnk All Version

Wiser for KNX (formerly homeLYnk)

Schneider Electric Wiser for KNX (formerly homeLYnk) All Version

Schneider Electric Wiser for KNX (formerly homeLYnk) V2.5.1

CVE-2020-7525

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists
which could allow an attacker to guess a password when brute force is used.

CVE Description

This vulnerability is fixed in V2.5.1 and is available for download below:
spaceLYnk: https://www.se.com/ww/en/product/LSS100200/spacelynk-logic-controller/

This vulnerability is fixed in V2.5.1 and is available for download below: Wiser for KNX (formerly homeLYnk): https://www.se.com/ww/en/product/LSS100100/wiser-forknx-logic-controller/

The following workarounds and mitigations can be applied by customers to reduce the risk:
• Keep the spaceLYnk and Wiser for KNX (formerly homeLYnk) devices behind a firewall,
create a firewall rule to whitelist only those devices allowed to access spaceLYnk and
Wiser for KNX (formerly homeLYnk) devices; do not allow direct access to the internet.
• Follow the General Security Recommendations in the section below.


Modicon M218 Logic Controller

Summary: Original Release

Summary: Modicon M218 Logic Controller - SEVD-2020-224-03 PDF Version

Summary: Modicon M218 Logic Controller - SEVD-2020-224-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Modicon M218 Logic Controller product.

Overview

Schneider Electric

Modicon M218 Logic Controller

Schneider Electric Modicon M218 Logic Controller V5.0.0.7 and prior

Schneider Electric Modicon M218 Logic Controller V5.0.0.8

CVE-2020-7524

A CWE-787:Out-of-bounds Write vulnerability exists which could cause Denial of Service when
sending specific crafted IPV4 packet to the controller:
Sending a specific IPv4 protocol package to Schneider Electric Modicon M218 Logic Controller
can cause IPv4 devices to go down. The device does not work properly and must be powered
back on to return to normal.

CVE Description

This vulnerability is fixed in version Firmware V5.0.0.8 and is available by contacting your
Schneider Electric local support or distributor.
Note: A reboot of the device is needed after update.

The following workarounds and mitigations can be applied by customers to reduce the risk:
• Setup network segmentation and implement a firewall to block all unauthorized access


APC Easy UPS On-Line Software

Summary: Original Release

Summary: APC Easy UPS On-Line Software - SEVD-2020-224-04 PDF Version

Summary: APC Easy UPS On-Line Software - SEVD-2020-224-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the APC Easy UPS On-Line Software,
which may lead to the uploading of executable files to non-specified directories by an
unauthorized user.

Overview

Schneider Electric

APC Easy UPS On-Line Software

Schneider Electric APC Easy UPS On-Line Software V2.0 and earlier

Schneider Electric APC Easy UPS On-Line Software V2.1

CVE-2020-7521

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulnerability exists when accessing a vulnerable method of `FileUploadServlet` which may lead
to uploading executable files to non-specified directories.

CVE Description

The vulnerabilities are fixed in V2.1 which is available for download below:
https://www.se.com/ww/en/product/SFAPV9601/apc-easy-ups-online-software/

The following workarounds and mitigations can be applied by customers to reduce the risk:
• Utilize application whitelisting software.
• Utilize firewall rules to limit network access to only those intended to connect.
• Update to V2.1 as soon as possible. Reboot if required at the end of the software
installation.

CVE-2020-7522

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulnerability occurs when accessing a vulnerable method of `SoundUploadServlet` which may
lead to uploading executable files to non-specified directories.

CVE Description


PowerChute Business Edition

Summary: Original Release

Summary: PowerChute Business Edition - SEVD-2020-224-05 PDF Version

Summary: PowerChute Business Edition - SEVD-2020-224-05 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the PowerChute Business Edition software
which may lead to remote code execution.

Overview

Schneider Electric

PowerChute Business Edition software

Schneider Electric PowerChute Business Edition software V9.0.x and earlier.

Schneider Electric PowerChute Business Edition software V9.1 and above.

CVE-2020-7526

A CWE-20: Improper Input Validation vulnerability exists which could cause remote code
execution when a script is executed during a shutdown event.

CVE Description

This vulnerability is fixed in version V9.1 and above. The latest versions are available for
download below:
https://www.apc.com/pcbe
• Update to the latest release V10.x or above (64-bit environment) or V9.5 or above (32-bit
environment)
• Reboot if required at the end of software installation.

The following workarounds and mitigations can be applied by customers to reduce the risk:
• Change user login password to a secure password.
• Utilize application whitelisting software.
• Utilize firewall rules to limit access to those intended to connect.


Harmony® eXLhoist

Summary: Original Release

Summary: Harmony® eXLhoist - SEVD-2020-224-06 PDF Version

Summary: Harmony® eXLhoist - SEVD-2020-224-06 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of the Bluetooth Low Energy vulnerability, known as SweynTooth,
which affects the Harmony® eXLhoist product.

Overview

Schneider Electric

Harmony® eXLhoist base stations

Schneider Electric Harmony® eXLhoist base stations V04.00.02.00 and prior

Schneider Electric Harmony® eXLhoist base stations V04.00.03.00

CVE-2019-19193

The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINKCC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5.0 before Q4 2019 for
CC2640R2 and CC2540/1 devices does not properly restrict the advertisement connection
request packet on reception, allowing attackers in radio range to cause a denial of service
(crash) via a crafted packet.

CVE Description

This vulnerability is fixed in base station V04.00.03.00 and is available for download below:
https://www.se.com/fr/fr/download/document/eXLhoistFirmwareV4060/


SoMove

Summary: Original Release

Summary: SoMove - SEVD-2020-224-07 PDF Version

Summary: SoMove - SEVD-2020-224-07 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the SoMove application.

Overview

Schneider Electric

SoMove

Schneider Electric SoMove V2.8.1 and prior

CVE-2020-7527

A CWE-276: Incorrect Default Permission vulnerability exists which could cause elevation of
privilege and provide full access control to local system users to SoMove component and
services when a SoMove installer script is launched.

CVE Description

This vulnerability is fixed in SoMove V2.8.2 and is available for download below:
https://www.se.com/ww/en/download/document/SoMove_FDT/

The following mitigations and workarounds can be applied by customers to reduce the risk:
• Manually update the access control permissions in the folder C:\Program Files
(x86)\Schneider Electric\SoMove by providing read only permission to users. This setting
will prevent everyone from overwriting file content without privileges.


Schneider Electric PACTware

Summary: Original Release

Summary: Updated version from V4.1 SP6 to V4.1 SP6a

Summary: Schneider Electric PACTware - SEVD-2020-224-08 PDF Version

Summary: Schneider Electric PACTware - SEVD-2020-224-08 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the PACTware product.

Overview

Schneider Electric

Schneider Electric PACTware

Schneider Electric Schneider Electric PACTware V5.0.5.30 and prior

Schneider Electric PACTware

<=4.1 SP5

Schneider Electric Schneider Electric PACTware V4.1 SP5 and prior

Schneider Electric PACTware

4.1 SP6a

Schneider Electric Schneider Electric PACTware V4.1 SP6a

Schneider Electric Schneider Electric PACTware V5.0.5.31

CVE-2020-9403

In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in a recoverable
format, and may be retrieved by any user with access to the PACTware workstation.

CVE Description

This vulnerability is fixed in versions V4.1 SP6a and V5.0.5.31 available for download below: V5.0.5.31 is available at:
https://www.se.com/ww/en/download/document/FD-SOFT-M-026/

This vulnerability is fixed in versions V4.1 SP6a and V5.0.5.31 available for download below:
4.1 SP6a is available through Global Customer Support site as TD70270673 at:
https://pasupport.schneiderelectric.com/qfdb/qfdisplay/search/searchresultframe.asp?QuickFixName=HF70270673&chkSh
owSuperseded=on

CVE-2020-9404

In PACTware before 4.1 SP6 and 5.x before 5.0.5.31, passwords are stored in an insecure
manner, and may be modified by an attacker with no knowledge of the current passwords.

CVE Description


Summary: Original Release

Summary:
Corrected fix version of RemoteConnect from
V2.3.2 to V2.4.2 package (page 2).

Summary:
Replaced CVE-2020-7528 with the pre-existing
CVE-2020-12525 assigned to M&M Software,
eliminating the duplicate entry for the same
vulnerability.(page 1).

Summary: SCADAPack x70 Remote Connect and  - SEVD-2020-252-01 PDF Version

Summary: SCADAPack x70 Remote Connect and  - SEVD-2020-252-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the SCADAPack x70 Remote Connect
and the SCADAPack x70 Security Administrator applications.

Overview

Schneider Electric

SCADAPack x70 Remote Connect

Schneider Electric SCADAPack x70 Remote Connect V3.6.3.574 and prior

SCADAPack x70 Security Administrator

Schneider Electric SCADAPack x70 Security Administrator V1.2.0 and prior

SCADAPack x70 RemoteConnect

Schneider Electric SCADAPack x70 RemoteConnect V3.7.3.904

SCADAPack x70 Security Administrator

Schneider Electric SCADAPack x70 Security Administrator V1.6.2

CVE-2020-12525

M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and
3.6.20304.x which is included in SCADAPack x70 is vulnerable to deserialization of untrusted
data in its project storage

CVE Description

For SCADAPack x70 Remote Connect and SCADAPack x70 Security Administrator these
vulnerabilities are fixed in SCADAPack x70 RemoteConnect V3.7.3.904 and SCADAPack x70
Security Administrator V1.6.2 respectively and are available for download in the link below, as
part of the RemoteConnect V2.4.2 package:
https://shop.exchange.se.com/en-US/apps/58663
There is no need to reboot.

The following workarounds and mitigations can be applied by customers to reduce the risk: Educate users to screen files from external sources and avoid files from untrusted sources before opening them in RemoteConnect or Security Administrator.

CVE-2020-7529

A CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Transversal’)
vulnerability exists which allows an attacker to place content in any unprotected folder on the
target system using a crafted .RCZ file.

CVE Description

CVE-2020-7530

A CWE-285 Improper Authorization vulnerability exists which allows improper access to
executable code folders.

CVE Description

CVE-2020-7531

A CWE-284 Improper Access Control vulnerability exists which allows an attacker to place
executables in a specific folder and run code whenever RemoteConnect is executed by the
user.

CVE Description

CVE-2020-7532

A CWE-502 Deserialization of Untrusted Data vulnerability exists which could allow arbitrary
code execution when an attacker builds a custom .SDB file containing a malicious serialized
buffer.

CVE Description


Summary: Original Release

Summary: CWE was updated.

Summary: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules - SEVD-2020-287-01 PDF Version

Summary: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules - SEVD-2020-287-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in the web server of the Modicon M340, Modicon
Quantum and Modicon Premium Legacy offers and their communication modules.
The Modicon Ethernet Programmable Automation products are controllers for industrial process
and infrastructure.
Failure to apply the remediations provided below may risk execution of commands on the
webserver by an authenticated attacker, which could result in loss of availability, confidentiality
and integrity on the controller.

Overview

Schneider Electric

M340 CPUs BMX P34x

Schneider Electric M340 CPUs BMX P34x prior to firmware version 3.20

Schneider Electric M340 Communication Ethernet modules BMX NOE 0100 (H) prior to version 3.3

Schneider Electric M340 Communication Ethernet modules BMX NOE 0110 (H) prior to version 6.5

Schneider Electric M340 Communication Ethernet modules BMX NOC 0401 prior to version 2.10

Schneider Electric Premium processors with integrated Ethernet COPRO TSXP574634, TSXP575634, TSXP576634 prior to 6.1 version

Schneider Electric Premium communication modules TSXETY4103 prior to version 6.2

Schneider Electric Premium communication modules TSXETY5103 prior to version 6.4

Schneider Electric Quantum processors with integrated Ethernet COPRO 140CPU65xxxxx prior to 6.1 version

Schneider Electric Quantum communication modules 140NOE771x1 prior to version 7.1

Schneider Electric Quantum communication modules 140NOC78x00 prior to version 1.74

Schneider Electric Quantum communication modules 140NOC77101 prior to version 1.08

M340 BMXP3420302 and CL and H

Schneider Electric M340 BMXP3420302 and CL and H version 3.20

M340 BMXP342020 and H

Schneider Electric M340 BMXP342020 and H  version 3.20

M340 BMXP342000

Schneider Electric M340 BMXP342000 version 3.20

M340 BMXP341000 and H

Schneider Electric M340 BMXP341000 and H version 3.20

M340 BMXP3420102 and CL

Schneider Electric M340 BMXP3420102 and CL version 3.20

M340 BMXP3420302

Schneider Electric M340 BMXP3420302 version 3.20

Schneider Electric M340 Communication Ethernet modules BMXNOE0100 and H version 3.3

Schneider Electric M340 Communication Ethernet modules BMXNOE0110 and H version 6.5

Schneider Electric M340 Communication Ethernet modules BMXNOC0401 version 2.10

Schneider Electric Premium Offers Premium processors with integrated Ethernet COPRO product references TSXP574634, TSXP575634, TSXP576634 version 6.1

Premium Offers TSXETY4103

Schneider Electric Premium Offers TSXETY4103 version 6.2

Premium Offers TSXETY5103

Schneider Electric Premium Offers TSXETY5103 version 6.4

Schneider Electric Quantum Offers Quantum processors with integrated Ethernet COPRO product reference 140CPU65xxxxx version 6.1

Quantum Offers 140NOE771x1

Schneider Electric Quantum Offers 140NOE771x1 version 7.1

Quantum Offers 140NOC78x00

Schneider Electric Quantum Offers 140NOC78x00 version 1.74

Quantum Offers 140NOC77101

Schneider Electric Quantum Offers 140NOC77101 version 1.08

CVE-2020-7533

CWE-287: Improper Authentication vulnerability exists which could cause the execution of commands on the webserver without authentication when sending specially crafted HTTP requests.

CVE Description

Customers should use appropriate patching methodologies when applying these patches to
their systems. We strongly recommend the use of back-ups and evaluating the impact of these
patches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch.


Wibu-Systems CodeMeter Vulnerabilities

Summary: Original Release

Summary: Wibu-Systems CodeMeter Vulnerabilities - SEVD-2020-287-02 PDF Version

Summary: Wibu-Systems CodeMeter Vulnerabilities - SEVD-2020-287-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities disclosed by Wibu-Systems in the
CodeMeter licensing manager product which is used by some Schneider Electric and Eurotherm
offers.
Failure to apply the remediations provided below may risk various types of attack on
CodeMeter, which could allow an attacker to alter and forge a license file, cause a denial-ofservice condition, potentially attain remote code execution, read heap data, and prevent normal
operation of third-party software dependent on the CodeMeter.
December 2020 update: The CodeMeter V7.10a fix qualification is confirmed for EcoStruxure
Machine SCADA Expert.

Overview

Schneider Electric

Schneider Electric EcoStruxure Machine Expert (formerly known as SoMachine and SoMachine Motion) All versions

Schneider Electric E+PLC400 All versions

Schneider Electric E+PLC100 All versions

Schneider Electric E+PLC_Setup All versions

EcoStruxure Machine SCADA Expert

Schneider Electric EcoStruxure Machine SCADA Expert All versions

CVE-2020-14509

Multiple memory corruption vulnerabilities exist where the packet parser mechanism of
CodeMeter (All versions prior to 7.10a) does not verify length fields. An attacker could send
specially crafted packets to exploit these vulnerabilities.

CVE Description

Schneider Electric is currently establishing a remediation plan for all future versions of products
impacted which do not have a fix available yet. We will update this document when the
remediation is available.
Until then, customers should note that the CodeMeter installation is independent from the
affected products reported in this security notification and should immediately apply the
following mitigations to reduce the risk of exploit:
Manually update CodeMeter to version 7.10a. This version is already available for download at
https://www.wibu.com/support/user
Additional Mitigations
• Import license files from trusted sources only.
• Set up network segmentation and configure firewalls to block all unauthorized access to
port 22350/TCP.
To ensure you are informed of all updates to this notification subscribe to Schneider Electric’s
security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2020-14513

CodeMeter (All versions prior to 6.81) and the software using it may crash while processing a
specifically crafted license file due to unverified length fields.

CVE Description

CVE-2020-14515

CodeMeter (All versions prior to 6.90 when using CmActLicense update files with CmActLicense
Firm Code) has an issue in the license-file signature checking mechanism, which allows
attackers to build arbitrary license files, including forging a valid license file as if it were a valid
license file of an existing vendor. Only CmActLicense update files with CmActLicense Firm
Code are affected.

CVE Description

CVE-2020-14517

Protocol encryption can be easily broken for CodeMeter (All versions prior to 6.90 are affected,
including Version 6.90 or newer only if CodeMeter Runtime is running as server) and the server
accepts external connections, which may allow an attacker to remotely communicate with the
CodeMeter API.

CVE Description

CVE-2020-14519

This vulnerability allows an attacker to use the internal WebSockets API for CodeMeter (All
versions prior to 7.00 are affected, including Version 7.0 or newer with the affected WebSockets
API still enabled. This is especially relevant for systems or devices where a web browser is
used to access a web server) via a specifically crafted Java Script payload, which may allow
alteration or creation of license files for when combined with CVE-2020-14515.

CVE Description

CVE-2020-16233

An attacker could send a specially crafted packet that could have CodeMeter (All versions prior
to 7.10) send back packets containing data from the heap.

CVE Description


Summary: Original Release

Summary: Smartlink, PowerTag, and Wiser Series Gateways - SEVD-2020-287-03 PDF Version

Summary: Smartlink, PowerTag, and Wiser Series Gateways - SEVD-2020-287-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Smartlink, PowerTag, and Wiser series
gateways.
Failure to apply the mitigation provided below may risk unauthorized access to the product.

Overview

Schneider Electric

Acti9 Smartlink SI D

Schneider Electric Acti9 Smartlink SI D all versions prior to 002.004.002

Acti9 Smartlink SI B

Schneider Electric Acti9 Smartlink SI B all versions prior to 002.004.002

Acti9 PowerTag Link / Link HD

Schneider Electric Acti9 PowerTag Link / Link HD all versions prior to 001.008.007

Acti9 Smartlink EL B

Schneider Electric Acti9 Smartlink EL B all versions prior to 1.2.1

Wiser Link

Schneider Electric Wiser Link all versions prior to 1.5.0

Wiser Energy

Schneider Electric Wiser Energy all versions prior to 1.5.0

Smartlink EL B

Schneider Electric Smartlink EL B version 1.2.1

Wiser Link

Schneider Electric Wiser Link version 1.5.0

Wiser Energy

Schneider Electric Wiser Energy version 1.5.0

CVE-2020-7548

CWE-330 - Use of Insufficiently Random Values vulnerability exists that could allow
unauthorized users to login.

CVE Description

Customers with impacted Smartlink SI B/D and PowerTag Link products should update to the
latest firmware using EcoStruxure Power Comission installer v.7.0 available here:
https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

Customers with impacted Wiser Link, Wiser Energy, and Smartlink EL B products should
immediately use the eSetup app to download version 1.5.0 for Wiser Link, Wiser Energy;
version 1.2.1 for Smartlink EL B.


EcoStruxure™ and SmartStruxure™ Power Monitoring and SCADA Software

Summary: Original Release

Summary: EcoStruxure™ and SmartStruxure™  - SEVD-2020-287-04 PDF Version

Summary: EcoStruxure™ and SmartStruxure™  - SEVD-2020-287-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ and SmartStruxure™
Power Monitoring & SCADA Software.
Failure to apply the mitigation provided below may risk remote code execution, which could
result in an attacker gaining root level access to the underlying operating system on the
impacted server.

Overview

Schneider Electric

EcoStruxure™ Power Monitoring Expert

Schneider Electric EcoStruxure™ Power Monitoring Expert version 9.0

Schneider Electric EcoStruxure™ Power Monitoring Expert version 8.x

Schneider Electric EcoStruxure™ Power Monitoring Expert version 7.x

EcoStruxure™ Energy Expert

Schneider Electric EcoStruxure™ Energy Expert version 2.0

Power Manager

Schneider Electric Power Manager version 1.1

Schneider Electric Power Manager version 1.2

Schneider Electric Power Manager version 1.3

Schneider Electric StruxureWare™ PowerSCADA Expert with Advanced Reporting and Dashboards Module version 8.x

Schneider Electric EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards Module version 9.0

EcoStruxure™ Power Monitoring Expert

Schneider Electric EcoStruxure™ Power Monitoring Expert Version 2020

EcoStruxure™ Energy Expert

Schneider Electric EcoStruxure™ Energy Expert version 3.0

Schneider Electric EcoStruxure™ Power SCADA Operations with Advanced Reporting and Dashboard Module Products version 2020

CVE-2020-7545

A CWE-284:Improper Access Control vulnerability exists that could allow for arbitrary code
execution on the server when an authorized user access an affected webpage.

CVE Description

These vulnerabilities have been fixed in EcoStruxure™
Power Monitoring Expert Version 2020, contact your
Schneider Electric representative for details on how to
upgrade your system.

These vulnerabilities have been fixed in EcoStruxure™
Energy Expert V3.0, contact your Schneider Electric
representative for details on how to upgrade your system

Contact customer support for mitigation instructions, or
your Schneider Electric representative for details on how to
upgrade your system.

These vulnerabilities have been fixed in EcoStruxure™
Power SCADA Operations with Advanced Reporting
and Dashboard Module Products version 2020., contact
your Schneider Electric representative for details on how to
upgrade your system.

CVE-2020-7546

A CWE-79: Improper Neutralization of Input During Web Page Generation vulnerability
exists that could allow an attacker to perform actions on behalf of the authorized
user when accessing an affected webpage.

CVE Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-7547

A CWE-284: Improper Access Control vulnerability exists that could allow a user the ability to
perform actions via the web interface at a higher privilege level.

CVE Description


Summary: Original Release

Summary: Added remediation for M340 CPU and BMXNOR0200H.

Summary: A remediation is available for Modicon M340 X80 Ethernet Communication Module BMXNOC0401.

Summary: A remediation is available on Modicon M340 Ethernet Communication Modules BMXNOE0100 (H) and BMXNOE0110 (H)

Summary: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules - SEVD-2020-315-01 PDF Version

Summary: Web Server on Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their Communication Modules - SEVD-2020-315-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the web server of the Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their communication modules.
The Modicon Ethernet Programmable Automation products are controllers for industrial process and infrastructure.
Failure to apply the mitigations provided below may risk write access and the execution of commands, which could result in corruption of data, or crash of the web server.
September 2022 Update: A remediation is available for Modicon M340 X80 Ethernet Communication Module BMXNOC0401

Overview

Schneider Electric

M340 CPUs BMXP34x

Schneider Electric M340 CPUs BMXP34x <3.40

Schneider Electric M340 CPUs BMXP34x 3.40

<1.7 IR 23

Schneider Electric M340 Communication Ethernet Modules BMXNOR0200H versions prior to 1.7 IR 23

1.7 IR 23

Schneider Electric M340 Communication Ethernet Modules BMXNOR0200H 1.7 IR 23

Schneider Electric M340 X80 Communication Ethernet Modules BMXNOC0401 versions prior to 2.11

Schneider Electric M340 X80 Communication Ethernet Modules BMXNOC0401 2.11

M340 Communication Ethernet modules

Schneider Electric M340 Communication Ethernet modules versions prior to SV03.50

Schneider Electric M340 Communication Ethernet modules versions prior to SV06.70

Schneider Electric M340 Communication Ethernet modules SV03.50

Schneider Electric M340 Communication Ethernet modules SV06.70

Schneider Electric Premium processors with integrated Ethernet COPRO all versions

Premium communication modules

Schneider Electric Premium communication modules all versions

Schneider Electric Quantum processors with integrated Ethernet COPRO 140CPU65xxxxx all versions

Quantum communication modules

Schneider Electric Quantum communication modules all verions

CVE-2020-7562

A CWE-125: Out-of-Bounds Read vulnerability exists which could cause a segmentation fault or a buffer overflow when uploading a specially crafted file on the controller over FTP.

CVE Description

V3.40 of M340 CPUs includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_xx.xx/

V1.70 IR23 of M340 Communication Ethernet Modules includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMXNOR0200H_FW/

V2.11of M340 X80 Communication Ethernet Modules includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/BMXNOC0401/ethernet-tcp-ip-network-module-modicon-m340-automation-platform-4-x-rj45-10-100/

Version SV03.50of BMXNOE0100 (H) includes a fix for thesevulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/BMXNOE0100_SV_03.50/

Version SV06.70 of BMXNOE0110 (H) includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/BMXNOE0110_SV_06.70/

If customers choose not to apply the remediation, then they should immediately apply the following mitigations to reduce the risk of exploit: •Setup network segmentation and implement a firewall to block all unauthorized access to port 80/HTTP (Note HTTP is disabled by default). •Configure the Access Control List following the recommendations of the user manual “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/•Setup a VPN between the Modicon PLC impacted modules and the engineering workstation containing EcoStruxure Control Expertor Process Expert.

Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer.
Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.
Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Configure the Access Control List following the recommendations of the user manual “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP Services Configuration Parameters / Connection Configuration Parameters”: https://www.se.com/ww/en/download/document/35006192K01000/
• Setup network segmentation and implement a firewall to block all unauthorized access to port 21/TCP

Schneider Electric’s Modicon Quantum controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.
Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Configure the Access Control List feature as mentioned in “Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter “Software Settings for Ethernet Communication / Messaging / Quantum NOE Ethernet Messaging Configuration”: https://www.se.com/ww/en/download/document/33002467K01000/
• Setup network segmentation and implement a firewall to block all unauthorized access to port 21/TCP

CVE-2020-7563

A CWE-787: Out-of-bounds Write vulnerability exists which could cause corruption of data, a crash, or code execution when uploading a specially crafted file on the controller over FTP.

CVE Description

CVE-2020-7564

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists which could cause write access and the execution of commands when uploading a specially crafted file on the controller over FTP.

CVE Description


Summary: Original Release

Summary:
Pro-face BLUE and WinGP added to list of
affected products (page 1-2)

Summary: EcoStruxure™ Operator Terminal Expert (Vijeo XD), Pro-face BLUE and WinGP runtime - SEVD-2020-315-02 PDF Version

Summary: EcoStruxure™ Operator Terminal Expert (Vijeo XD), Pro-face BLUE and WinGP runtime - SEVD-2020-315-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Operator Terminal Expert
(formerly known as Vijeo XD), Pro-face BLUE and WinGP runtimes. This vulnerability impacts
Windows PC and Harmony iPC offers.
The EcoStruxure™ Operator Terminal Expert and Pro-face BLUE products are HMI
configuration software supporting gestures and UI designs.
WinGP is a runtime engine on Windows PC and is included in Pro-face GP-Pro EX product
which is an HMI Screen Editor & Logic Programming Software for Pro-face.
Failure to apply the remediations provided below may risk unauthorized command execution by
a local user of the Windows engineering workstation, which could result in loss of availability,
confidentiality and integrity of the workstation where EcoStruxure™ Operator Terminal Expert ,
Pro-face BLUE or WinGP runtime is installed.
January 2021 update: Added Pro-face BLUE and WinGP to the list of products affected and
links to the fixes

Overview

Overview

Schneider Electric

<=3.1 Service Pack 1A

Schneider Electric EcoStruxure™ Operator Terminal Expert Runtime installed on Windows PC using legacy BIOS 3.1 Service Pack 1A and prior

Schneider Electric EcoStruxure™ Operator Terminal Expert Runtime installed on Harmony iPC(HMIG3U) using legacy BIOS 3.1 Service Pack 1A and prior

Schneider Electric Pro-face BLUE Runtime installed on Windows PC using legacy BIOS 3.1 Service Pack 1A and prior

Schneider Electric Pro-face BLUE Runtime installed on Pro-face iPC (SP-5B10) using legacy BIOS 3.1 Service Pack 1A and prior

Schneider Electric WinGP installed on Windows PC using legacy BIOS V4.09.120 and prior

Schneider Electric WinGP installed on Pro-face PS4000 & PS5000 series and SP-5B40, SP5B41 using legacy BIOS V4.09.120 and prior

EcoStruxure™ Operator Terminal Expert

3.1 Service Pack 1B

Schneider Electric EcoStruxure™ Operator Terminal Expert V3.1 Service Pack 1B

Pro-face BLUE

3.1 Service Pack 1B

Schneider Electric Pro-face BLUE V3.1 Service Pack 1B

CVE-2020-7544

CWE-269 Improper Privilege Management vulnerability exists that could cause privilege
escalation on the workstation when interacting directly with a driver installed by the runtime
software of EcoStruxure™ Operator Terminal Expert or Pro-face BLUE or WinGP.

CVE Description

• V3.1 Service Pack 1B of the EcoStruxure™ Operator Terminal Expert includes a fix for
this vulnerability and is available for download here: https://www.se.com/ww/en/productrange-download/62621-ecostruxure%E2%84%A2-operator-terminal-expert/#/softwarefirmware-tab
o This fix is also available through Schneider Electric Software Update (SESU). Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center https://www.se.com/ww/en/work/services/field-services/industrial-automation/industrial-cybersecurity/industrial-cybersecurity.jsp or Pro-face's Customer Care Center https://www.proface.com/en/contact if you need assistance removing a patch.

V3.1 Service Pack 1B of the Pro-face BLUE includes a fix for this vulnerability and is
available for download here: https://www.proface.com/en/service#/page/installer/blue. Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center https://www.se.com/ww/en/work/services/field-services/industrial-automation/industrial-cybersecurity/industrial-cybersecurity.jsp or Pro-face's Customer Care Center https://www.proface.com/en/contact if you need assistance removing a patch.

V4.09.200 of the WinGP, included in GP-Pro EX, includes a fix for this vulnerability and is
available for download here: https://www.proface.com/en/download/trial/gpproex/v40
o Reinstall WinGP on the affected products. Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center https://www.se.com/ww/en/work/services/field-services/industrial-automation/industrial-cybersecurity/industrial-cybersecurity.jsp or Pro-face's Customer Care Center https://www.proface.com/en/contact if you need assistance removing a patch.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Use EcoStruxure™ Operator Terminal Expert, Pro-face BLUE, or WinGP software only
on a trusted workstation.
• Harden your workstation following the best cybersecurity practices (antivirus, updated
operating systems, strong password policies, application White Listing software, etc.)
using the following guideline: https://www.se.com/us/en/download/document/CS-BestPractices-2019-340/
• Use Windows PC with UEFI technology. Customers can identify if their PC uses the
UEFI technology by using the following system command: msinfo32.exe provided by
Microsoft Windows. This command provides the system information. The section BIOS
mode displays either “UEFI” or “LEGACY”.
o If the value is UEFI, the PC is not vulnerable, if the value is LEGACY then the
PC is vulnerable


Summary: Original Release

Summary: Updated CWE for CVE-2020-7551 and CVE-2020-7552

Summary: Interactive Graphical SCADA System (IGSS) - SEVD-2020-315-03 PDF Version

Summary: Interactive Graphical SCADA System (IGSS) - SEVD-2020-315-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Interactive Graphical SCADA
System (IGSS) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling
industrial processes. IGSS communicates with all major industry standard PLC drivers.
Failure to apply the remediations provided below may risk remote code execution, which could
result in an attacker gaining access to the Windows Operating System on the machine used to
import CGF files, typically a step performed during system design time.

Overview

Schneider Electric

IGSS Definition (Def.exe)

Schneider Electric IGSS Definition (Def.exe) versions 14.0.0.20247 and prior

IGSS Definition module: Def.exe

Schneider Electric IGSS Definition module: Def.exe Version 14.0.0.20248

CVE-2020-7550

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could cause Remote Code Execution when malicious CGF
(Configuration Group File) file is imported to IGSS Definition.

CVE Description

Version 14.0.0.20248 of the IGSS Definition module: Def.exe includes a fix for this vulnerability
and is available for download through IGSS Master > Update IGSS Software or here:
https://igss.schneider-electric.com/igss/igssupdates/v140/IGSSUPDATE.ZIP
Customers should use appropriate patching methodologies when applying these patches to
their systems. We strongly recommend the use of back-ups and evaluating the impact of these
patches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center https://www.se.com/us/en/work/support/ if you need assistance removing a patch.

Customers should also consider upgrading to the latest product offering IGSS V15:
https://igss.schneider-electric.com/licensed-versions/ to resolve this issue.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Avoid importing CGF files from untrusted sources.

CVE-2020-7551

CWE-787: Out-of-bounds Write vulnerability exists that could cause Remote Code Execution
when malicious CGF (Configuration Group File) file is imported to IGSS Definition.

CVE Description

CVE-2020-7552

CVE Description

CVE-2020-7553

CWE-787 Out-of-bounds Write vulnerability exists that could cause Remote Code Execution
when malicious CGF (Configuration Group File) file is imported to IGSS Definition.

CVE Description

CVE-2020-7554

CVE Description

CVE-2020-7555

CVE Description

CVE-2020-7556

CVE Description

CVE-2020-7557

CWE-125 Out-of-bounds Read vulnerability exists that could cause Remote Code Execution
when malicious CGF (Configuration Group File) file is imported to IGSS Definition.

CVE Description

CVE-2020-7558

CVE Description


EcoStruxure Building Operation (EBO)

Summary: Original Release

Summary: EcoStruxure Building Operation (EBO) - SEVD-2020-315-04 PDF Version

Summary: EcoStruxure Building Operation (EBO) - SEVD-2020-315-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Building Operation
(EBO) product offerings. More information on the product line can be found at the following link:
https://www.se.com/ww/en/product-range-presentation/62111-ecostruxure%E2%84%A2-
building-operation/?parent-subcategory-id=1210&filter=business-2-building-automation-andcontrol#tabs-top
Failure to apply the mitigations/remediations provided below may risk various types of attacks
and cause various types of impact (see information below for each vulnerability).

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance removing a patch.

Overview

Schneider Electric

WebReports

Schneider Electric WebReports V1.9 - V3.1

WebStation

Schneider Electric WebStation V2.0 - V3.1

Enterprise Server installer

Schneider Electric Enterprise Server installer V1.9 - V3.1

Enterprise Central installer

Schneider Electric Enterprise Central installer V2.0 - V3.1

CVE-2020-7569

CWE-434 Unrestricted Upload of File with Dangerous Type vulnerability exists that could
cause an authenticated remote user being able to upload arbitrary files due to incorrect
verification of user supplied files and achieve remote code execution.

CVE Description

Alessandro Bosco
Luca Di Giuseppe
Alessandro Sabetta
Massimiliano Brolli

TIM Security Red Team Research (TIM S.p.A.)

Version 3.2 of EBO is not impacted by any of the vulnerabilities. It is highly recommended to
upgrade to this version. For assistance in upgrading, contact Schneider Electric’s Customer
Care Center or your Schneider Electric representative.
For versions prior to 3.2, fixes are now available in the form of a hotfix patch for the following
versions and products.
Step 1: Locate the version you need to patch on the Exchange
Community by accessing community.exchange.se.com https://community.exchange.se.com/and
searching for ‘EBO Hotfix List’ or alternatively, browse to the
following URL:
https://community.exchange.se.com/t5/EBO-Hotfix-List/bgp/sbo-hotfix-list
Step 2: Follow the instructions in the readme file

If customers choose not to apply the remediations provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Do not expose any EBO Server to an untrusted network.
• Locate the EBO system behind firewalls on a segregated network. Limiting external
access to only those machines and specific network ports that are necessary.
• Test and deploy Application Whitelisting on Server Machines.

CVE-2020-7570

CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site
Scripting Stored) vulnerability exists that could cause an authenticated remote user being able
to inject arbitrary web script or HTML due to incorrect sanitization of user-supplied data and
achieve a Cross-Site Scripting stored attack against other WebReport users.

CVE Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2020-7571

CWE-79 Multiple Improper Neutralization of Input During Web Page Generation (Cross-site
Scripting Reflected) vulnerability exists that could cause a remote attacker to inject arbitrary web
script or HTML due to incorrect sanitization of user supplied data and achieve a Cross-Site
Scripting reflected attack against other WebReport users.

CVE Description

CVE-2020-7572

CWE-611 Improper Restriction of XML External Entity Reference vulnerability exists that
could cause an authenticated remote user being able to inject arbitrary XML code and obtain
disclosure of confidential data, denial of service, server side request forgery due to improper
configuration of the XML parser.

CVE Description

CVE-2020-7573

CWE-284 Improper Access Control vulnerability exists that could cause a remote attacker
being able to access a restricted web resources due to improper access control.

CVE Description

CVE-2020-28209

CWE-428 Windows Unquoted Search Path vulnerability exists that could cause any local
Windows user who has write permission on at least one of the subfolders of the Connect Agent
service binary path, being able to gain the privilege of the user who started the service. By
default, the Enterprise Server and Enterprise Central is always installed at a location requiring
Administrator privileges so the vulnerability is only valid if the application has been installed on a
non-secure location.

CVE Description

Version 3.2 of EBO is not impacted by any of the vulnerabilities. It is highly recommended to
upgrade to this version. For assistance in upgrading, contact Schneider Electric’s Customer
Care Center or your Schneider Electric representative.
For versions prior to 3.2, fixes are now available in the form of a hotfix patch for the following
versions and products.
Step 1: Locate the version you need to patch on the Exchange
Community by accessing community.exchange.se.com https://community.exchange.se.com/ and
searching for ‘EBO Hotfix List’ or alternatively, browse to the
following URL:
https://community.exchange.se.com/t5/EBO-Hotfix-List/bgp/sbo-hotfix-list
Step 2: Follow the instructions in the readme file.

CVE-2020-28210

CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)
vulnerability exists that could cause an attacker to inject HTML and JavaScript code into the
user's browser.

CVE Description

Version 3.2 of EBO is not impacted by any of the vulnerabilities. It is highly recommended to
upgrade to this version. For assistance in upgrading, contact Schneider Electric’s Customer
Care Center or your Schneider Electric representative.
For versions prior to 3.2, fixes are now available in the form of a hotfix patch for the following
versions and products
Step 1: Locate the version you need to patch on the Exchange
Community by accessing community.exchange.se.com https://community.exchange.se.com/ and
searching for ‘EBO Hotfix List’ or alternatively, browse to the
following URL:
https://community.exchange.se.com/t5/EBO-Hotfix-List/bgp/sbo-hotfix-list
Step 2: Follow the instructions in the readme file.
Note: WebStation is not an installer of its own but is part of the
EBO server (SmartX, ES or EC)


Summary: Original Release

Summary: Added CVE-2020-28214 (page 2)

Summary: Added M100/M200 to the list of impacted products (page 1)

Summary: Modicon M100/M200/M221 Programmable Logic Controller - SEVD-2020-315-05 PDF Version

Summary: Modicon M100/M200/M221 Programmable Logic Controller - SEVD-2020-315-05 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Modicon M100, M200, and M221
products.
The Modicon M100/M200/M221 are Nano Programmable Logic Controllers (PLC) made to
control basic automation for machines. The M100/M200/M221 are configured using Machine
Expert - Basic software.
Failure to apply the mitigations provided below may allow unauthorized users to replay
authentication sequences, which could result in an attacker taking control over the PLC.
January 2021 update: Added Modicon M100 and M200 to the list of affected products.

Overview

Schneider Electric

Modicon M100 all references

Schneider Electric Modicon M100 all references all versions

Modicon M200 all references

Schneider Electric Modicon M200 all references all versions

Modicon M221 all references

Schneider Electric Modicon M221 all references all versions

CVE-2020-7565

CWE-326: Inadequate Encryption Strength vulnerability exists that could allow the attacker to
break the encryption key when the attacker has captured the traffic between EcoStruxure
Machine - Basic software and Modicon M100/M200/M221 controllers.

CVE Description

Yangyang Geng
Ke Liu
Houzhi Liu
YaHui Yang
Shunkai Zhu
Peng Cheng
Jie Meng
Mufeng Wang
Rei Henigman

Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP.
• Within the Modicon M100/M200/M221 application, the user must:
o Disable all unused protocols, especially Programming protocol, as described in
section "Configuring Ethernet Network" of EcoStruxure Machine Expert - Basic
online help for the M100/M200/M221 PLCs. This action will prevent unintended
remote programming access.
o Set a password to protect the project
o Set a password for read access on the controller
o Set a different password for write access on the controller

CVE-2020-7566

CWE-334: Small Space of Random Values vulnerability exists that could allow the attacker to
break the encryption keys when the attacker has captured the traffic between EcoStruxure
Machine - Basic software and Modicon M100/M200/M221 controllers.

CVE Description

CVE-2020-7567

CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow the
attacker to find the password hash when the attacker has captured the traffic between
EcoStruxure Machine - Basic software and Modicon M100/M200/221 controllers and broke the
encryption keys.

CVE Description

CVE-2020-7568

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that
could allow non sensitive information disclosure when the attacker has captured the traffic
between EcoStruxure Machine - Basic software and Modicon M100/M200/M221 controllers.

CVE Description

CVE-2020-28214

CWE-760: Use of a One-Way Hash with a Predictable Salt vulnerability exists that could allow
an attacker to pre-compute the hash value using dictionary attack technique such as rainbow
tables, effectively disabling the protection that an unpredictable salt would provide.

CVE Description


Easergy T300

Summary: Original Release

Summary:
Added the following CVEs: CVE-2020-28215,
CVE-2020-28216, CVE-2020-28217, CVE-2020-
28218. Updated CWE for CVE-2020-7561. (page
1-2).

Summary: Easergy T300 - SEVD-2020-315-06 PDF Version

Summary: Easergy T300 - SEVD-2020-315-06 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Easergy T300 RTU (Remote Terminal Unit).
The Easergy T300 is a modular platform for medium voltage and low voltage public distribution
network management.
Failure to apply the remediation provided below may allow unauthorized access to the internal
product LAN (local area network).
December 2020 Update: Additional CVEs have been added to this disclosure (marked in red).
No additional action is required for customers who have already followed the remediation
instructions provided below.

Overview

Schneider Electric

Easergy T300

Schneider Electric Easergy T300 2.7 and older

CVE-2020-7561

CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause a
wide range of problems, including information exposure, denial of service, and command
execution when access to a resource from an attacker is not restricted or incorrectly restricted.

CVE Description

Customers are strongly encouraged to upgrade to V2.7.1 available from the Schneider Electric
Customer Care Center. Alternatively, they may disable port forwarding in the product firewall.

CVE-2020-28215

CWE-862: Missing Authorization vulnerability exists that could cause a wide range of
problems, including information exposures, denial of service, and arbitrary code
execution when access control checks are not applied consistently.

CVE Description

CVE-2020-28216

CWE-311: Missing Encryption of Sensitive Data vulnerability exists that would allow an
attacker to read network traffic over HTTP protocol.

CVE Description

CVE-2020-28217

CWE-311: Missing Encryption of Sensitive Data vulnerability exists that would allow an
attacker to read network traffic over IEC60870-5-104 protocol.

CVE Description

CVE-2020-28218

CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that
would allow an attacker to trick a user into initiating an unintended action.

CVE Description


Summary: Original Release

Summary: Future remediation plan will include a fix for CVE-2020-7559 (page 2)

Summary: PLC Simulator for EcostruxureTM Process Expert has been added as an affected product. In addition, a new mitigation option has been added. (page 1-3)

Summary: Added fix of CVE-2020-7559 for PLC Simulator for EcoStruxure™ Control Expert

Summary: PLC Simulator on EcoStruxure™ Control Expert and Process Expert - SEVD-2020-315-07 PDF Version

Summary: PLC Simulator on EcoStruxure™ Control Expert and Process Expert - SEVD-2020-315-07 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its PLC Simulator for EcoStruxure™ Control Expert product.
PLC Simulator feature is part of the EcostruxureTM Control Expert and EcostruxureTM Process Expert software and it helps users to review and test their configurations files in a simulation environment; it is not intended to be used as a controller CPU in a production environment.
Failure to apply the mitigations provided below may risk unauthorized command execution or denial of service, which could result in undesired actions by the PLC simulator software.
March 2023 Update: An additional mitigation has been provided using a Cybersecurity Application Note (page 3).

Overview

Schneider Electric

<15.0 SP1

Schneider Electric PLC Simulator for EcoStruxure™ Control Expert prior to v15.0 SP1

Schneider Electric PLC Simulator for Unity Pro (former name of EcoStruxure™ Control Expert) all versions

Schneider Electric PLC Simulator for EcoStruxure™ Process Expert all versions

EcoStruxure™ Control Expert

15.0 SP1

Schneider Electric EcoStruxure™ Control Expert 15.0 SP1

CVE-2020-7559

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause a crash of the PLC simulator present in EcoStruxure™ Control Expert software and EcoStruxure™ Process Expert when receiving a specially crafted request over Modbus.

CVE Description

EcoStruxure™ Control Expert Version 15.0 SP1 product includes a fix for the vulnerability CVE-2020-7559 and is available for download here:
https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_15SP1
Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure.
Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately follow the recommendations in the Mitigation section below to reduce the risk of exploit.

Customers should immediately apply the following mitigations to reduce the risk of exploit of the CVE-2020-7538, CVE-2020-28211, CVE-2020-28212, CVE-2020-28213
• V15.0 of the EcoStruxure™ Control Expert software includes a mitigation for these vulnerabilities, when applied with the steps outlined below, and is available for download here:

https://www.se.com/ww/en/product-range-download/548-ecostruxure%E2%84%A2-control-expert/?parent-subcategory-id=3950&filter=business-1-industrial-automation-and-control&selected-node-id=12365959203#/software-firmware-tab
• EcoStruxure™ Process Expert 2020 R2 software, includes a mitigation, when applied with the steps outlined below, for these vulnerabilities and is available for download on the EcoStruxure Process Expert Support Portal (registration is needed):
https://app.schneider-electric.com/ecostruxure-hybrid-dcs/
After downloading the updated software listed above, the following steps are required to mitigate the vulnerability:
1. Harden the Engineering Workstation running PLC Simulator
o Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
o To help protect workstations running Schneider Electric and other user applications against execution of unauthorized applications and malicious files, Schneider Electric recommends using McAfee Application and Change Control software. Refer to the Cybsercurity Application Note available here.
2. On V15.0 of the EcoStruxure™ Control Expert and EcoStruxure™ Process Expert 2020 R2 software, in the option dialog box of the PLC simulator, customers are requested to set the Listening IP Address to:
a. 127.0.0.1 (localhost), which will prevent remote network connections to the PLC simulator; or
b. When deployed as a remote access system the IP Address should be configured to be the same as the system that will be running the PLC simulator.
Note: Customers are informed that on EcoStruxure™ Control Expert v15.0 and EcoStruxure™ Process Expert 2020 R2 software and prior, the default listening IP address is: 0.0.0.0. The default setting exposes the PLC simulator to the vulnerabilities described in this bulletin. The default listening IP address is configurable from v15.0 and 2020 R2 and above.
Update: Starting with EcoStruxure™ Control Expert v15.0 SP1 and above the default listening IP address is: 127.0.0.1. The same setting is also recommended for the PLC Simulator and is documented in the PLC Simulator user manual available here

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch

If customers choose not to apply the mitigations provided above or in case of older versions of EcoStruxure™ Control Expert software, they should immediately apply the following mitigations to reduce the risk of exploit:
1. Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
2. Harden the Engineering Workstation running PLC Simulator for EcoStruxure™ Control Expert and EcoStruxure™ Process Expert
o Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

CVE-2020-28212

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause unauthorized command execution when a brute force attack is done over Modbus.

CVE Description

CVE-2020-28213

A CWE-494: Download of Code Without Integrity Check vulnerability exists that could cause unauthorized command execution when sending specially crafted requests over Modbus.

CVE Description

CVE-2020-7538

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a crash of the PLC simulator present in EcoStruxure™ Control Expert software and EcoStruxure™ Process Expert when receiving a specially crafted request over Modbus.

CVE Description

CVE-2020-28211

A CWE-863: Incorrect Authorization vulnerability exists that could cause bypass of authentication when overwriting memory using a debugger.

CVE Description


Summary: Original Release

Summary:
Added fix availability on Ecostruxure Control
Expert v15.0 SP1 and added EcoStruxure™
Process Expert and RemoteConnect as impacted
product. (pages 1-3)

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and RemoteConnect™ (V2.0) - SEVD-2020-343-01 (V2.0) PDF Version

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and RemoteConnect™ (V2.0) - SEVD-2020-343-01 (V2.0) CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Control Expert product and
EcoStruxure™ Process Expert.
The EcoStruxure™ Control Expert product is a software to design, diagnose, maintain and update
applications for Modicon M340, M580 and M580 Safety, Momentum, Premium, and Quantum
PLCs.
The EcoStruxure Process Expert DCS (formerly EcoStruxure Hybrid DCS) is a single automation
system to engineer, operate, and maintain your entire infrastructure for a sustainable, productive
and market-agile plant
The RemoteConnect™ product is a Windows-based application based on EcoStruxure™ Control
Expert (Unity Pro) software components that provides a programming and configuration
environment for the SCADAPack x70 RTU series, which is comprised of the SCADAPack 470,
474, 570, 574 and 575 Smart RTUs.
Failure to apply the mitigations provided below may risk opening a malicious file, which could
result in crash of the software or unexpected code execution.
July 2021 update: Added availability of fix in the version 15.0 SP1 of EcoStruxure Control Expert
and added EcoStruxure™ Process Expert and RemoteConnect™ as impacted products.

Overview

Schneider Electric

EcoStruxure™ Control Expert

<15.0 SP1

Schneider Electric EcoStruxure™ Control Expert prior to v15.0 SP1

Schneider Electric Unity Pro (former name of EcoStruxure™ Control Expert) all versions

EcoStruxure™ Process Expert

Schneider Electric EcoStruxure™ Process Expert all versions

RemoteConnect™

Schneider Electric RemoteConnect™ all versions

EcoStruxure Control Expert

15.0 SP1

Schneider Electric EcoStruxure Control Expert v15.0 SP1

CVE-2020-7560

CWE-123 - Write-what-where Condition vulnerability exists that could cause a crash of the
software or unexpected code execution when opening a malicious file in the engineering
software.

CVE Description

EcoStruxure Control Expert v15.0 SP1 product includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_15SP1
Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch. If
customers choose not to apply the remediation provided above, they should immediately apply
the following mitigations to reduce the risk of exploit.
If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
Important Note:
• The fix is provided through the additional feature “file encryption”, for further information
on the feature and how to set it up please refers to the chapter “file encryption” of the
help file available in the EcoStruxure Control Expert v15.0 SP1.
• This feature is proposed by default when creating a new project.
• This feature is also available, after selecting “project” in structural view, in the “Edit/
Properties/ Project & Controller Protection” menu.
• For new projects:
o Customers are recommended to apply this feature to all new projects.
• For existing projects:
o Customers are recommended to apply this feature to the existing projects coming
from trusted source. For .sta project files, as a reminder, project modification can
be done in connected mode to prevent desynchronization and keep the controller
in RUN state.
• It is possible to set a security level specific to the Derived Function Blocks (DFB) in
addition to the file encryption feature. Please refer to the chapter "How to protect a DFB
type" in the EcoStruxure Control Expert help file for further information.
• Customers are recommended to share project files only when configured with the
encryption feature described above.
We strongly recommend the use of back-ups and evaluating the impact of these patches in a
Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance removing a patch.

If
customers choose not to apply the remediation provided above, they should immediately apply
the following mitigations to reduce the risk of exploit.
If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to
verify the integrity before usage
• Harden the workstation running EcoStruxure Control Expert or Unity Pro

Schneider Electric is establishing a remediation plan for the future product versions of
EcoStruxure™ Process Expert and RemoteConnect™ that will include a fix for the
above vulnerability.
We will update this document when the remediation is available. Until then, customers should
immediately apply the following mitigations to reduce the risk of exploit:

• Store the project files in a secure storage and restrict the access to only trusted users
• When exchanging files over the network, use secure communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check the consistency of this hash to
verify the integrity before usage
• Harden the workstation running EcoStruxure™ Control Expert, EcoStruxure™ Process
Expert or RemoteConnect™