Summary: Original Release

Summary:
Increased robustness of EcoStruxure Control
Expert against the CVE-2020-7475 in software
version 15.0 by enabling a new verification
mechanism on key components (page 2)

Summary:
Remediation Update: Customers on
EcoStruxure™ Control Expert versions prior to
V15.0 are recommended to upgrade to remediate
CVE-2020-7475 (page 2)

Summary: Modicon Controllers, EcoStruxure™ Control Expert and Unity Pro Programming Software - SEVD-2020-080-01 PDF Version

Summary: Modicon Controllers, EcoStruxure™ Control Expert and Unity Pro Programming Software - SEVD-2020-080-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Researchers from Airbus Cybersecurity have made Schneider Electric aware of a vulnerability
in two versions of Schneider Electric's Modicon programmable controllers and its EcoStruxure
Control Expert (formerly Unity Pro) programming software.
Since alerting us to the vulnerability, Airbus Cybersecurity and Schneider Electric have
collaborated to validate the research and to assess its true impact. Our mutual findings
demonstrate that while the discovered vulnerability affects Schneider Electric offers, it equally
impacts many other vendors and the global industrial automation market in general, especially
when the baseline assumption of the attack technique Airbus Cybersecurity demonstrated is
considered. Given certain conditions, and assuming an attacker has access to the network,
many devices available from several different industrial control vendors are likewise vulnerable.
Details of the vulnerability and a remediation are included below. However, as a general
guideline, Schneider Electric and Airbus Cybersecurity encourage all industrial companies to
ensure they have implemented cybersecurity best practices across their operations and supply
chains to reduce cyber risks. Where appropriate this includes locating industrial systems and
remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized
access; preventing mission-critical systems and devices from being accessed from outside
networks; systematically applying security patches and activating antivirus software; and
applying whitelisting solutions.
For more detail on Airbus Cybersecurity's research, please visit their blog https://airbus-cyber-security.com/blog/ .
May 2021 Remediation Update: Customers on EcoStruxure™ Control Expert versions prior to
V15.0 are recommended to upgrade to remediate CVE-2020-7475.

Overview

• Perform a Self-test: o EcoStruxure Control Expert V15 will self-test the integrity of its key components when the software is launched. If the results of the test are incorrect, a Windows warning will appear (“Integrity Check - Severe Warning!”) listing the invalid software components. If this happens, the software must be reinstalled! o This test can be performed at any time by selecting the Help menu, then choosing About EcoStruxure Control Expert/Perform Self-test. • Harden the Engineering Workstation o Follow workstation, network and site-hardening guidelines in the Cybersecurity Best Practices guide available for download here https://www.se.com/ww/en/download/document/7EN52-0390/ . • Enable Application Whitelisting o Schneider Electric strongly recommends applying a whitelisting solution to mitigate the risk of this and other vulnerabilities. For assistance with this step, please contact our Cybersecurity Services team https://www.se.com/us/en/work/services/cybersecurity-services/ .

Product Specific Recommendations

Schneider Electric

EcoStruxure™ Control Expert

Schneider Electric EcoStruxure™ Control Expert all versions prior to V15.0

Unity Pro

Schneider Electric Unity Pro all versions

Modicon M340

Schneider Electric Modicon M340 all versions prior to V3.20

Modicon M580

Schneider Electric Modicon M580 all versions prior to V3.10

EcoStruxure Control Expert

Schneider Electric EcoStruxure Control Expert V15.0

M340 BMXP3420302 and CL and H

Schneider Electric M340 BMXP3420302 and CL and H V3.20 or above

M340 BMXP342020 and H

Schneider Electric M340 BMXP342020 and H V3.20 or above

M340 BMXP342000

Schneider Electric M340 BMXP342000 V3.20 or above

M340 BMXP341000 and H

Schneider Electric M340 BMXP341000 and H V3.20 or above

M340 BMXP3420102 and CL

Schneider Electric M340 BMXP3420102 and CL V3.20 or above

M340 BMXP3420302

Schneider Electric M340 BMXP3420302 V3.20 or above

M580 BMEP584040

Schneider Electric M580 BMEP584040 V3.10 or above

M580 BMEH584040 and C

Schneider Electric M580 BMEH584040 and C V3.10 or above

M580 BMEP586040 and C

Schneider Electric M580 BMEP586040 and C V3.10 or above

M580 BMEH586040 and C

Schneider Electric M580 BMEH586040 and C V3.10 or above

M580 BMEP581020 and H

Schneider Electric M580 BMEP581020 and H V3.10 or above

M580 BMEP582020 and H

Schneider Electric M580 BMEP582020 and H V3.10 or above

M580 BMEP582040 and H

Schneider Electric M580 BMEP582040 and H V3.10 or above

M580 BMEP583020

Schneider Electric M580 BMEP583020 V3.10 or above

M580 BMEP583040

Schneider Electric M580 BMEP583040 V3.10 or above

M580 BMEP584020

Schneider Electric M580 BMEP584020 V3.10 or above

M580 BMEP585040 and C

Schneider Electric M580 BMEP585040 and C V3.10 or above

M580 BMEH582040 and C

Schneider Electric M580 BMEH582040 and C V3.10 or above

Schneider Electric M580 BMEP584040S BMEH584040S BMEH586040S BMEP582040S V3.10 or above

CVE-2020-7475

CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream
Component ('Injection'), reflective DLL, vulnerability exists, which, if exploited, could allow
attackers to transfer malicious code to the controller.

CVE Description

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP584040: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEH584040 and C: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP586040 and C: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEH586040 and C: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP581020 and H: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP582020 and H: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP582040 and H: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP583020: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP583040: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP584020: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP585040 and C: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEH582040 and C: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMEP584040S
BMEH584040S
BMEH586040S
BMEP582040S: update to firmware V3.10 or above
(Available in the Download Links section) Please contact Schneider Electric Support to receive the firmware
version 3.10
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M580:
• Setup a secure communication according to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000001999.06.pdf&p_Doc_Ref=EIO0000001999
• Optional: Additional countermeasure to protect the controller:
Use a BMENOC module and follow the instructions to configure IPSEC feature
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation, and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/#page=1&toolbar=1&scrollbar=1&status
bar=1&view=fit

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller BMXP3420302 and CL and H: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M340:
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=31007131_K01_000_16.pd
f&p_Doc_Ref=31007131K01000
For assistance enabling the hotfix or to apply these steps, please contact our Customer Care
Center.

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller BMXP342020 and H: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M340:
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=31007131_K01_000_16.pd
f&p_Doc_Ref=31007131K01000
For assistance enabling the hotfix or to apply these steps, please contact our Customer Care
Center.

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller BMXP342000: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M340:
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=31007131_K01_000_16.pd
f&p_Doc_Ref=31007131K01000
For assistance enabling the hotfix or to apply these steps, please contact our Customer Care
Center.

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller BMXP341000 and H: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M340:
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=31007131_K01_000_16.pd
f&p_Doc_Ref=31007131K01000
For assistance enabling the hotfix or to apply these steps, please contact our Customer Care
Center.

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controller BMXP3420102 and CL: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M340:
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=31007131_K01_000_16.pd
f&p_Doc_Ref=31007131K01000
For assistance enabling the hotfix or to apply these steps, please contact our Customer Care
Center.

After downloading the new version, found in the Download Links section below, all of the
following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware:
• On the engineering workstation:
o Recommended remediation: update to EcoStruxure Control Expert V15.0
(Available in the Download Links section)
• On the Modicon M340 controllerBMXP3420302: update to firmware V3.20 or above
(Available in the Download Links section)
• On the Modicon M580 controller: update to firmware V3.10 or above
(Available in the Download Links section)
STEP 2: Update projects in Ecostruxure Control Expert by:
• Setting up an application password in the project properties
• Changing the version of the controller firmware to match the new firmware version of the
target controller
STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:
• Rebuild all current projects
• Transfer them to Modicon controllers
STEP 4: Configure the Access Controls on Modicon controllers:
• Setup network segmentation and implement a firewall to block all unauthorized access
to port 502/TCP
Modicon M340:
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=31007131_K01_000_16.pd
f&p_Doc_Ref=31007131K01000
For assistance enabling the hotfix or to apply these steps, please contact our Customer Care
Center.


Modicon M100/M200/M221 controllers, SoMachine Basic and EcoStruxure Machine Expert - Basic Programming Software

Summary: Original Release

Summary: Modicon M100/M200/M221 controllers, SoMachine Basic and - SEVD-2020-105-01 PDF Version

Summary: Modicon M100/M200/M221 controllers, SoMachine Basic and - SEVD-2020-105-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Modicon M100/M200/M221 controllers,
SoMachine Basic and EcoStruxure Machine Expert - Basic products.

Overview

Schneider Electric

SoMachine Basic

Schneider Electric SoMachine Basic All Version

EcoStruxure Machine Expert - Basic

vers.all/*

Schneider Electric EcoStruxure Machine Expert - Basic All Version

Modicon M100 Logic Controller

Schneider Electric Modicon M100 Logic Controller All Version

Modicon M200 Logic Controller

Schneider Electric Modicon M200 Logic Controller All Version

Modicon M221 Logic Controller

Schneider Electric Modicon M221 Logic Controller All Version

EcoStruxure Machine Expert - Basic

>=1.0 SP2

Schneider Electric EcoStruxure Machine Expert - Basic >=V1.0 SP2

Modicon M100 Logic Controller

Latest Version

Schneider Electric Modicon M100 Logic Controller Latest Verison

Modicon M200 Logic Controller

Latest Version

Schneider Electric Modicon M200 Logic Controller Latest Verison

Modicon M221 Logic Controller

Latest Version

Schneider Electric Modicon M221 Logic Controller Latest Verison

CVE-2020-7489

A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream
Component ('Injection') vulnerability exists in EcoStruxure Machine Expert – Basic or
SoMachine Basic programming software. The result of this vulnerability, DLL substitution, could
allow the transference of malicious code to the controller.

CVE Description

The following workarounds and mitigations can be applied by customers to reduce the risk. All
steps are required.
STEP 1: Update software and firmware.
• On the engineering workstation, update to EcoStruxure Machine Expert - Basic V1.0
SP2 or above: https://www.se.com/fr/fr/product-range-download/2226-
ecostruxure%E2%84%A2-machine-expert/#/software-firmware-tab
• On Modicon M100/M200/M221 Logic controllers, update to latest firmware version.
STEP 2: Update projects in EcoStruxure Machine Expert – Basic.
• Upgrade the functional level of the application to version 10.2
Activate the application protection for both read and write in the project properties
STEP 3: Transfer applications.
• Transfer applications to Modicon M100/M200/M221 logic controllers. EcoStruxure
Machine Expert – Basic will perform integrity check when transferring the application
and will display a warning pop-up to the user if the application has been altered
during transfer.

• Harden the Engineering Workstation
o Follow workstation, network, and site hardening guidelines in the
Cybersecurity Best Practices guide available for download here.
• Enable Application Whitelisting
o Schneider Electric strongly recommends applying a whitelisting solution to
mitigate the risk of this and other vulnerabilities. For assistance with this step,
contact our Cybersecurity Services team.


Summary: Original Release

Summary: Remediation update for M258 (page 2)

Summary: Modicon M218/M241/M251/M258 Logic Controllers,SoMachine/SoMachine Motion, EcoStruxure™ Machine Expert - SEVD-2020-105-02 PDF Version

Summary: Modicon M218/M241/M251/M258 Logic Controllers,SoMachine/SoMachine Motion, EcoStruxure™ Machine Expert - SEVD-2020-105-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Modicon M218, M241, M251 and
M258 Logic Controllers, SoMachine & SoMachine Motion, and EcoStruxure Machine Expert
products.
The Ecostruxure Machine Expert products are programmable logic controllers and associated
programming software.
Failure to apply the remediations provided below may risk denial of service or potential arbitrary
code execution.
Nov 2020 Update: Added remediation for M258

Overview

Secure the network communications between the engineering workstation and the controllers to ensure trustworthiness.• Harden the Engineering Workstationo Follow workstation, network, and site hardening guidelines in the Cybersecurity Best Practices guide available for download here https://www.se.com/ww/en/download/document/CS-Best-Practices-2019-340/ . • Enable Application WhitelistingSchneider Electric strongly recommends applying a whitelisting solution to mitigate the risk of this and other vulnerabilities. For assistance with this step, contact our Cybersecurity Services team https://www.se.com/us/en/work/services/field-services/industrial-automation/industrial-cybersecurity/industrial-cybersecurity.jsp .

Product Specific Reccomendations

Schneider Electric

EcoStruxure Machine Expert

Schneider Electric EcoStruxure Machine Expert all versions prior to v1.2

SoMachine, SoMachine Motion

Schneider Electric SoMachine, SoMachine Motion all versions

Modicon M218 Logic Controller

Schneider Electric Modicon M218 Logic Controller all versions

Modicon M241 Logic Controller

Schneider Electric Modicon M241 Logic Controller all versions prior to v5.0.8.4

Modicon M251 Logic Controller

Schneider Electric Modicon M251 Logic Controller all versions prior to v5.0.8.4

Modicon M258 Logic Controller

Schneider Electric Modicon M258 Logic Controller all versions prior to v5.0.4.11

Modicon M258

Schneider Electric Modicon M258 V5.0.4.11

CVE-2020-7487

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow
the attacker to execute malicious code on the Modicon M218, M241, M251, and M258
controllers.

CVE Description

For Modicon M258 (all versions prior to V5.0.4.11):
Modicon M258 offer has been migrated to EcoStruxure Machine Expert v1.2.5. A fix has
been implemented for both (CVE-2020-7087 and CVE-2020-7488) vulnerabilities on
firmware version V5.0.4.11. We recommend the customer to migrate from the legacy
SoMachine application to the new version of EcoStruxure Machine Expert application
(https://www.se.com/fr/fr/product-range-download/2226-ecostruxure%E2%84%A2-
machine-expert/#/software-firmware-tab) and update the firmware to the latest version
through Schneider Electric Software Update (SESU).

The following workarounds and mitigations should be applied by customers to reduce
the risk. All steps are required.
Step 1: Update software and firmware.
• On the engineering workstation, update to EcoStruxure Machine Expert v1.2 or
above: https://www.se.com/fr/fr/product-range-download/2226-
ecostruxure%E2%84%A2-machine-expert/#/software-firmware-tab

The following workarounds and mitigations should be applied by customers to reduce
the risk. All steps are required.
Step 1: Update software and firmware.
• On Modicon M218/M241/M251 Logic Controllers, update to latest firmware
version available through Schneider Electric Software Update (SESU)

CVE-2020-7488

CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could
leak sensitive information transmitted between the software and the Modicon M218, M241,
M251, and M258 controllers.

CVE Description


Vijeo Designer and Vijeo Designer Basic

Summary: Original Release

Summary:
Corrected affected version of Vijeo Designer to
V6.2 SP9 and prior (page 1)

Summary:
Updated fix availability for Vijeo Designer V6.2
SP10 (page 1)

Summary: Vijeo Designer and Vijeo Designer Basic - SEVD-2020-105-03 PDF Version

Summary: Vijeo Designer and Vijeo Designer Basic - SEVD-2020-105-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Vijeo Designer and Vijeo Designer Basic
Software products.

Overview

Schneider Electric

Vijeo Designer Basic

<=1.1 HotFix 15

Schneider Electric Vijeo Designer Basic V1.1 HotFix 15 and prior

Vijeo Designer

<=6.2 SP9

Schneider Electric Vijeo Designer V6.2 SP9 and prior

Vijeo Designer Basic

1.1 HotFix 16

Schneider Electric Vijeo Designer Basic v1.1 HotFix 16

Vijeo Designer

6.2 SP10

Schneider Electric Vijeo Designer v6.2 SP10

CVE-2020-7490

A CWE-426: Untrusted Search Path vulnerability exists, which could cause arbitrary code
execution on the system running Vijeo Basic when a malicious DLL library is loaded by the
product.

CVE Description

This vulnerability is fixed in Vijeo Designer Basic version V1.1 HotFix 16. Please contact your
Schneider Electric Customer Support to get Vijeo Designer Basic version V1.1 HotFix 16
software.
This vulnerability is fixed in version Vijeo Designer V6.2 SP10 released in July 2020:
• For customers using Vijeo Designer version V6.1 or earlier, please contact your
Schneider Electric Customer Support to obtain the Vijeo Designer V6.2 SP10.
• For customers using a version of Vijeo Designer V6.2 or greater, Vijeo Designer V6.2
SP10 will be automatically available in Schneider Electric Software Update (SESU)
software.

The following workarounds and mitigations can be applied to Vijeo Designer Basic and Vijeo
Designer by customers to reduce the risk:
 Harden the Engineering Workstation - follow workstation, network, and site hardening
guidelines in the Cybersecurity Best Practices guide available for download here.


Summary: Original Release

Summary: Updated fix availability for Vijeo Designer

Summary: Vijeo Designer and Vijeo Designer Basic Software - SEVD-2020-133-02 PDF Version

Summary: Vijeo Designer and Vijeo Designer Basic Software - SEVD-2020-133-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Vijeo Designer Basic and Vijeo Designer
software products.

Overview

Schneider Electric

Vijeo Designer Basic

<=1.1 HotFix 16

Schneider Electric Vijeo Designer Basic V1.1 HotFix 16 and prior

Vijeo Designer Basic

1.1 HotFix 17

Schneider Electric Vijeo Designer Basic V1.1 HotFix 17

Vijeo Designer

6.2 SP10

Schneider Electric Vijeo Designer V6.2 SP10

CVE-2020-7501

A CWE-798: Use of Hard-coded Credentials vulnerability exists which could cause
unauthorized read and write when downloading and uploading project or firmware into Vijeo
Designer Basic and Vijeo Designer.

CVE Description

This vulnerability is fixed in version Vijeo Designer Basic V1.1 HotFix 17. Please contact your
Schneider Electric Customer Support to obtain the HotFix.
This vulnerability is fixed in version Vijeo Designer V6.2 SP10 released in July 2020.
• For customers using Vijeo Designer version V6.1 or earlier, please contact your
Schneider Electric Customer Support to obtain the Vijeo Designer V6.2 SP10.
• For customers using a version of Vijeo Designer V6.2 or greater, Vijeo Designer V6.2
SP10 will be automatically available in Schneider Electric Software Update (SESU)
software.

The following workarounds and mitigations can be applied to Vijeo Designer Basic and Vijeo
Designer by customers to reduce the risk:
• Enable “Download security” to override its hardcoded password and refer to “4.8.2.2
Protecting Targets from Unauthorized Project Downloads” in online help.
• Setup network segmentation and implement a firewall to block all unauthorized access
to port TCP/6001 (Not standard FTP port).


U.motion Servers and Touch Panels

Summary: Original Release

Summary: Updated Acknowledgements section (page 4).

Summary: Updated CWE for CVE-2020-7499

Summary: U.motion Servers and Touch Panels - SEVD-2020-133-03 PDF Version

Summary: U.motion Servers and Touch Panels - SEVD-2020-133-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the U.motion servers and touch panel
products.

Overview

Schneider Electric

MTN6501-0001 – U.Motion – KNX Server

Schneider Electric MTN6501-0001 – U.Motion – KNX Server prior to 1.4.2

Schneider Electric MTN6501-0002 – U.Motion – KNX Server Plus prior to 1.4.2

Schneider Electric MTN6260-0410 – U.Motion KNX server Plus, Touch 10 prior to 1.4.2

Schneider Electric MTN6260-0415 – U.Motion KNX server Plus, Touch 15 prior to 1.4.2

Schneider Electric MTN6260-0310 – U.Motion KNX Client Touch 10 prior to 1.4.2

Schneider Electric MTN6260-0315 – U.Motion KNX Client Touch 15 prior to 1.4.2

Schneider Electric MTN6501-0001 – U.Motion – KNX Server 1.4.2

Schneider Electric MTN6501-0002 – U.Motion – KNX Server Plus 1.4.2

Schneider Electric MTN6260-0410 – U.Motion KNX server Plus, Touch 10 1.4.2

Schneider Electric MTN6260-0415 – U.Motion KNX server Plus, Touch 15 1.4.2

Schneider Electric MTN6260-0310 – U.Motion KNX Client Touch 10 1.4.2

Schneider Electric MTN6260-0315 – U.Motion KNX Client Touch 15 1.4.2

CVE-2020-7499

A CWE-863: Incorrect Authorization vulnerability exists which could cause unauthorized access
when a low privileged user makes unauthorized changes.

CVE Description

MTN6501-0001 – U.motion – KNX Server
https://www.se.com/ww/en/product/MTN6501
-0001/u.motion---knx-server/

MTN6501-0002 – U.Motion – KNX Server
Plus
https://www.se.com/ww/en/product/MTN6501
-0002/u.motion---knx-server-plus/

MTN6260-0410 – U.Motion KNX server Plus,
Touch 10
https://www.se.com/ww/en/product/MTN6260
-0410/

MTN6260-0415 – U.Motion KNX server Plus,
Touch 15
https://www.se.com/ww/en/product/MTN6260
-0415/

MTN6260-0310 – U.Motion KNX Client
Touch 10
https://www.se.com/ww/en/product/MTN6260
-0310/

MTN6260-0315 – U.Motion KNX Client
Touch 15
https://www.se.com/ww/en/product/MTN6260
-0315/

The following workarounds and mitigations can be applied by customers to reduce the risk:
• Do not allow direct internet access to the U.motion servers and touch panels.
• Keep the U.motion servers and touch panels behind a firewall.

CVE-2020-7500

A CWE-89:Improper Neutralization of Special Elements used in an SQL Command ('SQL
Injection') vulnerability exists which could cause arbitrary code to be executed when a malicious
command is entered.

CVE Description


Modicon M218 Logic Controller

Summary: Original Release

Summary: Modicon M218 Logic Controller - SEVD-2020-161-01 PDF Version

Summary: Modicon M218 Logic Controller - SEVD-2020-161-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Modicon M218 Logic Controller product.

Overview

Schneider Electric

Modicon M218 firmware

Schneider Electric Modicon M218 firmware V4.3 and prior

CVE-2020-7502

A CWE-787: Out-of-bounds Write vulnerability exists, which may cause a Denial of Service
when specific TCP/IP crafted packets are sent to the Modicon M218 Logic Controller.

CVE Description

The following workarounds and mitigations can be applied by customers to reduce the risk:
Since the vulnerability is present in the TCP/IP stack of the Modicon M218 Logic Controller
product, an active network connection is required to exploit it. Therefore, Schneider Electric
customers can act now to mitigate the risk of attack by limiting access to their devices, which
would immediately reduce attempted exploits:
• Limit access to the networks on which Schneider Electric devices are placed.
• Do not expose Schneider Electric devices directly to the Internet.
• Always place Schneider Electric devices behind firewalls and/or other security protection
appliances that limit access only to authorized remote connections.
• Continuously monitor affected devices for security events that could warn of attempted
unauthorized access.
• Secure the network communications between the engineering workstation and the
controllers to ensure trustworthiness by following the Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/CS-Best-Practices-2019-340/
For more details and assistance on how to protect your installation, please contact your local
Schneider Electric’s Industrial Cybersecurity Services organization.
This notification will be updated as remediation become available with a dedicated patch fixing
the vulnerability


Summary: Original Release

Summary: Modicon LMC078 Logic Controller additional URGENT/11 Fix - SEVD-2020-161-03 PDF Version

Summary: Modicon LMC078 Logic Controller additional URGENT/11 Fix - SEVD-2020-161-03 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability introduced in the VxWorks patch delivered by Wind
River fixing URGENT/11 vulnerabilities affecting the Modicon LMC078 Logic Controller

Overview

Schneider Electric

Modicon LMC078 Logic Controller

Schneider Electric Modicon LMC078 Logic Controller running with firmware V1.51.15.05 and later

CVE-2020-10664

The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL
Pointer Dereference.
Additional details on this specific vulnerability can be found on the Wind River security
notification webpage: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE2020-10664

CVE Description

Modicon LMC078 Logic Controller does not allow IGMP communication protocol by default.
No configuration or Schneider feature allows joining a multicast source group.
The following workarounds and mitigations can be applied by customers to enforce
cybersecurity on Modicon LMC078 Logic Controllers:
Since the vulnerability is present in the TCP/IP stack, an active network connection is
required to exploit it. Therefore, Schneider Electric customers can act now to mitigate the
risk of attack by limiting access to their devices, which would immediately reduce attempted
exploits.
• Use functions recommended and documented by Schneider Electric:
https://product-help.schneiderelectric.com/Machine%20Expert/V1.2/LandingPages/en/VLP_Software/VLP_Lib_Te
mp_Ex/VLP_Libraries/VLP_Communication_Libraries/index.html
• Limit access to the networks on which Schneider Electric devices are placed.
• Do not expose Schneider Electric devices directly to the Internet.
• Always place Schneider Electric devices behind firewalls and other security
protection appliances that limit access only to authorized remote connections.
• Continuously monitor affected devices for security events that could warn of
attempted unauthorized access.
• Secure the network communications between the engineering workstation and the
controllers to ensure trustworthiness by following the Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/CS-Best-Practices-2019-340/


Easergy T300

Summary: Original Release

Summary: Updated CWE for CVE-2020-7506

Summary: Easergy T300 - SEVD-2020-161-04 PDF Version

Summary: Easergy T300 - SEVD-2020-161-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Researchers from Rostelecom-Solar have made Schneider Electric aware of multiple
vulnerabilities affecting the company’s Easergy T300 product. Schneider Electric has worked
closely with the researchers to remediate the vulnerabilities. We appreciate their collaboration
and commitment to transparency. The vulnerabilities have been remediated via a free firmware
update, which is available immediately by contacting Schneider Electric’s Customer Care
Center.
Access to the customer’s network is required for the majority of the disclosed vulnerabilities to
be exploited. Therefore, if the customer’s network is well protected and monitored for intrusion,
and care is taken to obtain software updates from a trusted source, the general risk of
exploitation can be substantially minimized.
Schneider Electric encourages customers to upgrade to the new firmware as soon as possible.
The company further encourages customers to ensure any firmware files used to update the
device are acquired from trusted sources; to operate the products on properly segmented
control networks; to adequately secure any workstation that has been configured to have
access to the product; and to follow the remediation and general security recommendations
below. T300 is a grid automation platform that is typically deployed to medium voltage (2400-69000 VAC) substation cabinets.

Overview

Schneider Electric

Easergy T300

Schneider Electric Easergy T300 with firmware V1.8.2 and prior

Schneider Electric Easergy T300 with firmware 2.7

CVE-2020-7503

CVE Description

This vulnerability is fixed in T300 firmware version 2.7 and is available from your Schneider
Electric Customer Care Center.

Additionally, Schneider Electric recommends customers apply the following mitigations to further
reduce risk:
• Ensure firmware is obtained from a trusted source and integrity is protected.
• Use a separate secure local network and use secure computer access controls.

CVE-2020-7504

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists which could allow an
attacker to execute malicious commands on behalf of a legitimate user when xsrf-token data is
intercepted.
A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists which could allow an
attacker to execute malicious commands on behalf of a legitimate user when xsrf-token data is
intercepted.
A CWE-20: Improper Input Validation vulnerability exists which could allow an attacker to
disable the webserver service on the device when specially crafted network packets are sent.

CVE Description

CVE-2020-7505

A CWE-494 Download of Code Without Integrity Check vulnerability exists which could allow an
attacker to inject data with dangerous content into the firmware and execute arbitrary code on
the system.

CVE Description

CVE-2020-7506

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists which could allow an attacker to pack or
unpack the archive with the firmware for the controller and modules using the usual tar archiver
resulting in an information exposure.

CVE Description

CVE-2020-7507

A CWE-400: Uncontrolled Resource Consumption vulnerability exists which could allow an
attacker to login multiple times resulting in a denial of service.

CVE Description

CVE-2020-7508

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists which
could allow an attacker to gain full access by brute force.

CVE Description

CVE-2020-7509

A CWE-269: Improper privilege management (write) vulnerability exists which could allow an
attacker to elevate their privileges and delete files.
A CWE-269: Improper privilege management (write) vulnerability exists which could allow an
attacker to elevate their privileges and delete files.

CVE Description

CVE-2020-7510

A CWE-200: Information Exposure vulnerability exists which could allow attacker to obtain
private keys.

CVE Description

CVE-2020-7511

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists which could
allow an attacker to acquire a password by brute force.

CVE Description

CVE-2020-7512

A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities
vulnerability exists which could allow an attacker to exploit the component.

CVE Description

CVE-2020-7513

A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists which could allow an
attacker to intercept traffic and read configuration data.

CVE Description


Easergy Builder

Summary: Original Release

Summary:
Updated CWE for CVE-2020-7515 and
CVE-2020-7516

Summary: Easergy Builder - SEVD-2020-161-05 PDF Version

Summary: Easergy Builder - SEVD-2020-161-05 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Researchers from Rostelecom-Solar have made Schneider Electric aware of multiple
vulnerabilities affecting the company’s Easergy Builder configuration tool. Schneider Electric
has worked closely with Ilya Karpov and Evgeniy Druzhinin of Rostelecom-Solar to remediate
the vulnerabilities and appreciates their collaboration and commitment to transparency. The
vulnerabilities have been remediated via a free software update, which is available immediately
by contacting Schneider Electric’s Customer Care Center.
Access to the customer’s network is required for the majority of the disclosed vulnerabilities to
be exploited. Therefore, if the customer’s network is well protected and monitored for intrusion,
and care is taken to obtain software updates from a trusted source, the general risk of
exploitation can be substantially minimized.
Schneider Electric encourages customers to upgrade to the new software as soon as possible.
The company further encourages customers to ensure any firmware files used to update the
device are acquired from trusted sources; to operate the products on properly segmented
control networks; to adequately secure any workstation that has been configured to have
access to the product; and to follow the remediation and general security recommendations
below.

Overview

Schneider Electric

Easergy Builder

Schneider Electric Easergy Builder version 1.4.7.2 and prior

Schneider Electric Easergy Builder version 1.6.3.0

CVE-2020-7514

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists which could
allow an attacker access to the authorization credentials for a device and gain full access.

CVE Description

This vulnerability is fixed in Easergy Builder version 1.6.3.0 and is available from your Schneider
Electric Customer Care Center.

Additionally, Schneider Electric recommends customers apply the following mitigations to further
reduce risk:
• Use a separate secure local network and use secure computer access controls

CVE-2020-7515

A CWE-798: Use of Hard-coded Credentials vulnerability exists which could allow an attacker to
decrypt a password.

CVE Description

CVE-2020-7516

A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists which could allow an
attacker access to login credentials.

CVE Description

CVE-2020-7517

A CWE-312: Cleartext Storage of Sensitive Information vulnerability exists which could allow an
attacker to read user credentials.

CVE Description

CVE-2020-7518

A CWE-20: Improper input validation vulnerability exists which could allow an attacker to modify
project configuration files.

CVE Description

CVE-2020-7519

A CWE-521: Weak Password Requirements vulnerability exists which could allow an attacker to
compromise a user account.

CVE Description


APC by Schneider Electric Network Management Cards (NMC) and NMC Embedded Devices

Summary: Original Release

Summary:
Updated Affected Products & Details and Vulnerability Details
sections formatting for clarity (pages 2-5)

Summary:
Updated remediation for “Uninterruptible Power Supply (UPS) using
NMC2” (page 2)

Summary:
Corrected affected version(s) and enhanced Remediation/Mitigation
version details for “Uninterruptible Power Supply (UPS) using NMC2”
(page 2)

Summary: Added remediation for Cooling Products using NMC2 (page 2)

Summary:
Updated overview section, available remediations and affected
products tables. New information regarding CVE-2020-11901. Added
remediations for “APC 3-Phase Power Distribution Products”, “APC Rack Power Distribution Units (PDU)”, :Rack Automatic Transfer
Switches (ATS)”, “Environmental Monitoring” (page 1-6)

Summary:
Added remediations for Uninterruptible Power Supply (UPS) using
NMC2, APC 3-Phase Power Distribution Products using NMC2, APC
Rack Power Distribution Units (PDU) using NMC2, Rack Automatic
Transfer Switches (ATS) using NMC2, Environmental Monitoring
using NMC2, Cooling Products using NMC2 (page 2-4)

Summary:
Added remediations for Uninterruptible Power Supply (UPS) using
NMC3 (page 2)

Summary:
Added remediations for Uninterruptible Power Supply (UPS), Rack
Power Distribution Units (rPDU), Battery Management, Rack
Automatic Transfer Switch (ATS), Rack Air Removal Unit (RARU)
using NMC1, as well as all other remaining NMC1 applications (page
2, 4-6)

Summary: APC by Schneider Electric Network Management Cards (NMC) and NMC Embedded Devices - SEVD-2020-174-01 PDF Version

Summary: APC by Schneider Electric Network Management Cards (NMC) and NMC Embedded Devices - SEVD-2020-174-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric became aware of multiple vulnerabilities affecting Treck Inc.'s embedded TCP/IP
stack, collectively known as Ripple20, which Treck publicly disclosed on June 16, 2020. Schneider
Electric is also aware of a proof of concept published by JSOF that demonstrates how one of the
Treck vulnerabilities, CVE-2020-11901, can be exploited to affect a Schneider Electric APC SmartUPS device using certain Network Management Card firmware versions.
On October 12, 2020, Schneider Electric received additional information and analysis from JSOF
related to CVE-2020-11901’s impact on APC by Schneider Electric Network Management Cards and
NMC embedded devices. This new analysis indicates that the information we originally received was
incomplete. Therefore our original remediations are only partially effective for CVE-2020-11901. We
are expediting updated remediations, which will be made available as soon as possible. In the
meantime, customers should immediately apply the mitigations included in Remediation & Mitigations
section of this document.
June 2021 Update: Added remediations for Uninterruptible Power Supply (UPS), Rack Power
Distribution Units (rPDU), Battery Management, Rack Automatic Transfer Switch (ATS), Rack Air
Removal Unit (RARU) using NMC1, as well as all other remaining NMC1 applications.

Overview

Schneider Electric

<=NMC2 AOS 6.9.4

Schneider Electric Uninterruptible Power Supply (UPS) using NMC2 1-Phase and 3-Phase UPS models including Smart-UPS, Symmetra, and Galaxy with Network Management Card 2 (NMC2): AP9630/AP9630CH/AP9630J NMC2 AOS V6.9.4 and earlier

Schneider Electric Uninterruptible Power Supply (UPS) using NMC2 1-Phase and 3-Phase UPS models including Smart-UPS, Symmetra, and Galaxy with Network Management Card 2 (NMC2): AP9631/AP9631CH/AP9631J NMC2 AOS V6.9.4 and earlier

Schneider Electric Uninterruptible Power Supply (UPS) using NMC2 1-Phase and 3-Phase UPS models including Smart-UPS, Symmetra, and Galaxy with Network Management Card 2 (NMC2): AP9635/AP9635CH NMC2 AOS V6.9.4 and earlier

Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9617 (discontinued in Nov 2011)

<=Smart-UPS NMC1 3.9.2

Schneider Electric Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9617 (discontinued in Nov 2011)  Smart-UPS NMC1 v3.9.2 and earlier

Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9619 (discontinued in Sep 2012)

Schneider Electric Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9619 (discontinued in Sep 2012) Smart-UPS NMC1 v3.9.2 and earlier

Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9618 (discontinued in Jan 2017)

Schneider Electric Uninterruptable Power Supply (UPS) using NMC1 - SUMX AP9618 (discontinued in Jan 2017) Smart-UPS NMC1 v3.9.2 and earlier

Uninterruptable Power Supply (UPS) using NMC1 - SUMX Smart-UPS models embedded with NMC1

Schneider Electric Uninterruptable Power Supply (UPS) using NMC1 - SUMX Smart-UPS models embedded with NMC1 Smart-UPS NMC1 v3.9.2 and earlier

<=NMC3 AOS 1.3.0.6

Schneider Electric Uninterruptible Power Supply (UPS) using NMC3 Network Management Card 3 (NMC3) SmartSlot card models: AP9640/AP9640J NMC3 AOS V1.3.0.6 and earlier

Schneider Electric Uninterruptible Power Supply (UPS) using NMC3 Network Management Card 3 (NMC3) SmartSlot card models: AP9641/AP9641J NMC3 AOS V1.3.0.6 and earlier

Battery Management Embedded NMC2 - Battery Manager - AP9922

<=NMC2 AOS 6.9.4

Schneider Electric Battery Management Embedded NMC2 - Battery Manager - AP9922 NMC2 AOS V6.9.4 and earlier

APC 3-Phase Power Distribution Products: InfraStruXure 150kVA PDU with 84 poles (X84P)

Schneider Electric APC 3-Phase Power Distribution Products: InfraStruXure 150kVA PDU with 84 poles (X84P) NMC2 AOS V6.9.4 and earlier

APC 3-Phase Power Distribution Products: InfraStruXure 40 and 60 kVA PDU (XPDU)

Schneider Electric APC 3-Phase Power Distribution Products: InfraStruXure 40 and 60 kVA PDU (XPDU) NMC2 AOS V6.9.4 and earlier

APC 3-Phase Power Distribution Products: Modular 150 and 175 kVA PDU NAM (XRDP)

Schneider Electric APC 3-Phase Power Distribution Products: Modular 150 and 175 kVA PDU NAM (XRDP) NMC2 AOS V6.9.4 and earlier

APC 3-Phase Power Distribution Products: 400 and 500 kVA PMM (PMM)

Schneider Electric APC 3-Phase Power Distribution Products: 400 and 500 kVA PMM (PMM) NMC2 AOS V6.9.4 and earlier

APC 3-Phase Power Distribution Products: Modular PDU/RPP (XRDP2G)

Schneider Electric APC 3-Phase Power Distribution Products: Modular PDU/RPP (XRDP2G) NMC2 AOS V6.9.4 and earlier

Schneider Electric APC Rack Power Distribution Units (rPDU) Embedded NMC2: 2G Metered/Switched Rack PDUs with embedded NMC2 NMC2 AOS V6.9.4 and earlier

APC Rack Power Distribution Units (rPDU) Embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX

Schneider Electric APC Rack Power Distribution Units (rPDU) Embedded NMC2: AP84XX, AP86XX, AP88XX, AP89XX NMC2 AOS V6.9.4 and earlier

<=NMC1 AOS 3.9.2

Schneider Electric APC Rack Power Distribution Units (rPDU) Embedded NMC1: Metered/Switched Rack PDUs with embedded NMC1 - AP78XX, AP79XX NMC1 AOS V3.9.2 and earlier

<=NMC2 AOS 6.8.8

Schneider Electric Rack Automatic Transfer Switches (ATS) Embedded NMC2: - Rack Automatic Transfer Switches - AP44XX NMC2 AOS V6.8.8 and earlier

<=NMC1 AOS 3.9.2

Schneider Electric Rack Automatic Transfer Switches (ATS) Embedded NMC1: - Rack Automatic Transfer Switches - AP77XX NMC1 AOS v3.9.2 and earlier

Environmental Monitoring Environmental Monitoring Unit with embedded NMC2 - NetBotz NBRK0250

<=NMC2 AOS 6.8.8

Schneider Electric Environmental Monitoring Environmental Monitoring Unit with embedded NMC2 - NetBotz NBRK0250 NMC2 AOS V6.8.8 and earlier

Cooling Products Embedded NMC2 & Touchscreen Displays: InRow

<=NMC2 AOS 6.9.4

Schneider Electric Cooling Products Embedded NMC2 & Touchscreen Displays: InRow NMC2 AOS V6.9.4 and earlier

Cooling Products Embedded NMC2 & Touchscreen Displays: Uniflair Cooling Devices

Schneider Electric Cooling Products Embedded NMC2 & Touchscreen Displays: Uniflair Cooling Devices NMC2 AOS V6.9.4 and earlier

Cooling Products Embedded NMC1 - Rack Air Removal Unit SX (RARU)

<=NMC1 AOS 3.9.2

Schneider Electric Cooling Products Embedded NMC1 - Rack Air Removal Unit SX (RARU) NMC1 AOS V3.9.2 and earlier

Schneider Electric NMC1 Products Symmetra UPS Network Management Card 1 (NMC1) SmartSlot Models: - AP9617 (discontinued in Nov 2011) NMC1 AOS V3.9.2 and earlier

Schneider Electric NMC1 Products Symmetra UPS Network Management Card 1 (NMC1) SmartSlot Models: - AP9619 (discontinued in Sep 2012) NMC1 AOS V3.9.2 and earlier

Schneider Electric NMC1 Products Symmetra UPS Network Management Card 1 (NMC1) SmartSlot Models: - AP9618 (discontinued in Jan 2017) NMC1 AOS V3.9.2 and earlier

Schneider Electric NMC1 Products Symmetra UPS Network Management Card 1 (NMC1) SmartSlot Models: - Audio/Video Network Management Enabled products S20BLK, G50NETB2, G50NETB-20A2 NMC1 AOS V3.9.2 and earlier

Battery Management - Battery Management System - AP9920B1

Schneider Electric Battery Management - Battery Management System - AP9920B1 NMC1 AOS V3.9.2 and earlier

Battery Management - Battery Management System - AP9921X

Schneider Electric Battery Management - Battery Management System - AP9921X NMC1 AOS V3.9.2 and earlier

Environmental Monitoring AP9319 AP9320 AP9340 AP9360 AP9361 NetBotz NBRK0200

Schneider Electric Environmental Monitoring AP9319 AP9320 AP9340 AP9360 AP9361 NetBotz NBRK0200 NMC1 AOS V3.9.2 and earlier

Cooling Products - NetworkAir

Schneider Electric Cooling Products - NetworkAir NMC1 AOS V3.9.2 and earlier

Cooling Products - InRow

<=NMC1 AOS 3.9.2

Schneider Electric Cooling Products - InRow NMC1 AOS V3.9.2 and earlier

NMC2 AOS

Schneider Electric NMC2 AOS V6.9.2/6.9.4

Schneider Electric NMC2 AOS V6.9.6 or later

Schneider Electric NMC2 AOS V3.9.4 or later

NMC3 AOS

Schneider Electric NMC3 AOS V1.4 or later

NMC1 AOS

Schneider Electric NMC1 AOS V3.9.4 or later

CVE-2020-11901

Network Management Card Family - Network Management Card 1 (NMC1), Network Management Card 2 (NMC2), Network Management Card 3 (NMC3)

CVE Description

Patches for the vulnerabilities have
begun being released for applications
running on the NMC2 platforms.
Customers are urged to upgrade to
applications using NMC2 AOS V6.9.6 or
later.
Note: AOS V6.9.2/6.9.4 addressed 14
of the 15 CVEs. AOS V6.9.6 addresses
CVE-2020-11901.
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

Patches for the vulnerabilities have
been released for the SUMX application
running on the NMC1 platform.
Customers are urged to upgrade to
applications using NMC2 AOS V3.9.4 or
later.
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

Patches for the vulnerabilities have
begun being released for applications
running on the NMC3 platforms.
Customers are urged to upgrade to
applications using NMC3 AOS V1.4 or
later.
Note: AOS V1.3.3.1 addressed 14 of
the 15 CVEs. NMC3 AOS V1.4
addresses CVE-2020-11901.
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

Patches for the vulnerabilities have
begun being released for applications
running on the NMC2 platform.
Customers are urged to upgrade to
applications using AOSV6.9.6 or later.

Note: AOS V6.9.2/6.9.4 addressed 14
of the 15 CVEs. AOS V6.9.6 addresses
CVE-2020-11901.
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

Patches for the vulnerabilities have
been released for applications running
on the NMC2 platform.
Customers are urged to upgrade to
applications using AOSV6.9.6 or later.

Note: AOS V6.9.2/6.9.4 addressed 14
of the 15 CVEs. AOS V6.9.6 addresses
CVE-2020-11901.
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

Patches for the vulnerabilities have
been released for applications running
on the NMC1 platform.
Customers are urged to upgrade to
applications using NMC1 AOSV3.9.4 or
later
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

Patches for the vulnerabilities have
been released for applications running
on the NMC1 and NMC2 platform.
Customers are urged to upgrade to
applications using NMC2 AOSV6.9.6 or
later or NMC1 AOSv3.9.4 or later

Note: NMC2 AOS V6.9.2/6.9.4
addressed 14 of the 15 CVEs. AOS
V6.9.6 addresses CVE-2020-11901.
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

Patches for the vulnerabilities have
been released for RARU NMC1
application
Customers are urged to upgrade to
applications using NMC1 AOSV3.9.4 or
later
Refer to this link for the latest
information on application patch
availability:
https://www.apc.com/us/en/faqs/FA410359/

These are End of Commercialization
offers.
To reduce risk of exploitation, apply
the mitigations detailed in the
Recommended Mitigations section.
Contact your local support team for
further assistance in upgrading to
NMC2 or NMC3 platforms.

Schneider Electric is implementing remediations which will be made available as soon as possible. In
the meantime, we recommend that our customers protect their installations from the cyber risks
associated with the Treck vulnerabilities by immediately taking these mitigating actions:
For devices on a local network:
 Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with
rulesets limiting access with only approved protocols and functions and to only those devices
and endpoints requiring access.
• Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to
the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 https://kb.cert.org/vuls/id/257161  for
details.
• Disable DHCP on the NMC and configure it to use a static IP address.
• To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all
servers the NMC will connect.
• If DNS must be used then normalize DNS through a secure recursive server or application
layer firewall
• Enable only secure remote access methods. Disable any insecure protocols.
For devices that must communicate via the Internet:
• Minimize network exposure for embedded and critical devices, keeping exposure to the
minimum necessary, and ensuring that devices are not accessible from the Internet unless
absolutely essential.
• Ensure communications to devices are via the EcoStruxure IT Gateway. The EcoStruxure IT
platform https://ecostruxureit.com/what-is-ecostruxure-it/  is security hardened with a mandatory two-factor authentication and high encryption
standards. Device data is securely transported to the EcoStruxure IT platform using the
EcoStruxure IT Gateway, which uses an outbound connection to minimize risk to your
environment.
If network access is not required:
• Remove the Ethernet cable from the SmartSlot NMC, or the embedded NMC Ethernet port if
an embedded NMC is present.
Additional mitigations:
• Access Controls: Install physical and logical controls, so that no unauthorized personnel or
device can access your systems, components, peripheral equipment, and networks.

CVE-2020-11902

Network Management Card Family - Network Management Card 2 (NMC2), Network Management Card 3 (NMC3)

CVE Description

CVE-2020-11903

Network Management Card Family - Network Management Card 1 (NMC1)

CVE Description

CVE-2020-11904

CVE Description

CVE-2020-11905

CVE Description

CVE-2020-11906

CVE Description

CVE-2020-11907

CVE Description

CVE-2020-11908

CVE Description

CVE-2020-11909

CVE Description

CVE-2020-11910

CVE Description

CVE-2020-11911

CVE Description

CVE-2020-11912

CVE Description

CVE-2020-11913

CVE Description

CVE-2020-11914

CVE Description

CVE-2020-11896

CVE Description

CVE-2020-11898

CVE Description

CVE-2020-11913

CVE Description