Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controller products.
The [Modicon Programmable Automation controllers](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/) are used for complex networked communication, display
and control applications
Failure to apply the mitigations or remediations provided below may risk execution of unsolicited command on
the PLC which could result in a loss of availability of the controller.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

Summary: Multiple Vulnerabilities in Modicon Controller Products - SEVD-2019-134-11 PDF Version

Summary: Multiple Vulnerabilities in Modicon Controller Products - SEVD-2019-134-11 CSAF Version

Multiple Vulnerabilities in Modicon Controller Products

Summary: Original Release

Summary: Updated to include links to M580 V2.90 Firmware and Control Expert Hot Fix v14.0

Summary: Updated mitigations for CVE-2019-6808

Summary: Updated links to M580 v2.90 Firmware

Summary:
Updated:
• CVE-2018-7846: added fix available for M340 v3.10
• CVE-2018-7849: added fix available for M340 v3.10
• CVE-2018-7848: added fix available for M340 v3.10
• CVE-2018-7842: added fix available for M340 v3.10
• CVE-2018-7847: added fix available for M340 v3.10
• CVE-2018-7850: added fix available for M340 v3.10
• CVE-2018-7854: added fix available for M340 v3.10
• CVE-2018-7852: modified to change M580 release which was erroneous (2.80
instead of 2.90)
• CVE-2018-7855: added fix available for M340 v3.10
• CVE-2019-6807: added fix available for M340 v3.10
• CVE-2019-6808: added fix available for M340 V3.10
• CVE-2018-7843: modified to change M340 release which was erroneous (3.01
instead of 3.10)
• CVE-2018-7856: added fix on M340 v3.10 (available earlier than expected)

Added 4 new CVEs:
• CVE-2019-6830
• CVE-2019-6828
• CVE-2019-6829
• CVE-2019-6809

Summary:
Updated:
• CVE-2019-6806: Corrected remediation information for Modicon M340
• CVE-2018-7845: Fix for Premium & Quantum
• CVE-2018-7843: Fix for Premium & Quantum
• CVE-2019-6809: Fix for Premium & Quantum
• CVE-2019-6807: Fix for Premium & Quantum
• CVE-2018-7857: Fix for Premium & Quantum
• CVE-2018-7856: Fix for Premium & Quantum
• CVE-2018-7852: Fix for Premium & Quantum
• CVE-2019-6828: Fix for Premium & Quantum
• Update of download links for latest versions of M580 / M340 & Quantum, plus
customer support information for Premium.

Summary: Updated fix version information for CVE-2018-7857

Summary:
Updated fix version information for CVE-2018-7857:
• Additional fixes available for M580 v3.10
• Quantum & Premium previous fix is not enough to correct the CVE and
requires the additional mitigations proposed

Summary:
Additional required remediation steps added for M580 and M340 applicable to the
following CVEs:
• CVE-2018-7846
• CVE-2018-7849
• CVE-2018-7843
• CVE-2018-7848
• CVE-2018-7842
• CVE-2018-7847
• CVE-2018-7850
• CVE-2018-7845
• CVE-2018-7852
• CVE-2018-7853
• CVE-2018-7854
• CVE-2018-7855
• CVE-2018-7856
• CVE-2018-7857
• CVE-2019-6807
• CVE-2019-6808
• CVE-2019-6830
• CVE-2019-6828
• CVE-2019-6829
• CVE-2019-6809

Summary:
A fix for additional attack scenario is available on M340 v3.30 for
CVE-2018-7857.

Summary:
Modicon MC80 and PLC Simulator for EcoStruxure™ Control Expert were added as
impacted product of CVE-2018-7857 and CVE-2019-6807 and the remediation is provided.

Summary:
Modicon M340 and M580 latest firmware versions are affected by CVE-2018-7855 and
additional mitigations were added in the mitigation section.

Summary:
A remediation is available for Modicon Momentum Unity M1E Processor part numbers
171CBU* for CVE-2018-7857 and CVE-2019-6807

Summary:
A remediation is available for Modicon M340 and M580 for CVE-2018-7855. Updated
products affected version numbers.

Summary:
Modicon MC80 and Momentum M1E PLCs were added as impacted products of CVE
2018-7855. Mitigations are available for Modicon MC80 and Momentum M1E PLCs for
CVE-2018-7855.

Summary: Correction of CVE list impacting Quantum Safety processor.

Summary: Remediation is available for CVE-2018-7855 in Modicon Momentum controller (Page 9)

Schneider Electric

Modicon M580 Firmware

Modicon M580 Firmware Versions prior to v2.90

Modicon M580 Firmware Versions prior to v2.80

Modicon M580 Firmware Versions prior to v4.20

Modicon M340 Firmware

Modicon M340 Firmware Versions prior to v3.10

Modicon M340 Firmware Versions prior to v3.01

Modicon M340 Firmware Versions prior to v3.60

Modicon MC80 Firmware

Modicon MC80 Firmware Versions prior to v1.80

Modicon Momentum Unity M1E Processor (part numbers 171CBU*) Controller

Modicon Momentum Unity M1E Processor Firmware Versions prior to sv2.6

Modicon Momentum Unity M1E Processor Firmware Versions prior to v2.90

Modicon Momentum Unity M1E Processor Firmware Version 2.90

Modicon Momentum Unity M1E Processor Firmware

Modicon Quantum Firmware

Modicon Quantum Firmware Versions prior to v3.60

Modicon Quantum Safety Firmware

Modicon Quantum Safety Firmware All Versions

Modicon Premium Firmware

Modicon Premium Firmware Versions prior to v3.20

EcoStruxure Control Expert

EcoStruxure Control Expert Versions prior to v15.1

Modicon M580 Firmware Versions prior to v2.90 installed on Modicon M580 Controller

Modicon M580 Firmware Versions prior to v2.80 installed on Modicon M580 Controller

Modicon M580 Firmware Versions prior to v4.20 installed on Modicon M580 Controller (part numbers BMEP* and BMEH*, excluding M580 CPU Safety)

Modicon M580 Firmware Version 4.20 installed on Modicon M580 Controller

Modicon M580 Firmware All Versions installed with Modicon M580 Controller

Modicon M340 Firmware Versions prior to v3.10 installed on Modicon M340 Controller

Modicon M340 Firmware Versions prior to v3.01 installed on Modicon M340 Controller

Modicon M340 Firmware Versions prior to v3.60 installed on Modicon M340 Controller (part numbers BMXP34*)

Modicon M340 Firmware Version 3.60 installed on Modicon M340 Controller

Modicon M340 Firmware All Versions installed on Modicon M340 Controller

Modicon MC80 Firmware Versions prior to v1.80 installed on Modicon MC80 Controller (BMKC8020301)

Modicon MC80 Firmware Version 1.80 installed on Modicon MC80 Controller

Modicon MC80 Firmware All Versions installed on Modicon MC80 Controller

Modicon Momentum Unity M1E Processor Firmware Versions prior to sv2.6 installed on Modicon Momentum Unity M1E Processor (part numbers 171CBU*) Controller

Modicon Momentum Unity M1E Processor Firmware Versions prior to v2.90 installed on Modicon Momentum Unity M1E Processor (part numbers 171CBU*) Controller

Modicon Momentum Unity M1E Processor Firmware Version 2.90 installed on Modicon Momentum Unity M1E Processor (part numbers 171CBU*) Controller

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU65150 [C] & 140CPU65160 [C]

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU65260 [C]

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU67261 [C]

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU67060 [C]

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU67160 [C]

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU67260 [C]

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU65860 [C]

Modicon Quantum Firmware Versions prior to v3.60 installed on Modicon Quantum Controller 140CPU67861 [C]

Modicon Quantum Firmware All Versions installed on Modicon Quantum Controller

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU65150 [C] & 140CPU65160 [C]

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU65260 [C]

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU67261 [C]

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU67060 [C]

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU67160 [C]

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU67260 [C]

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU65860 [C]

Modicon Quantum Firmware Version 3.60 installed on Modicon Quantum Controller 140CPU67861 [C]

Modicon Quantum Safety Firmware All Versions installed on Modicon Quantum Safety Controller

Modicon Premium Firmware Versions prior to v3.20 installed on Modicon Premium Controller

Modicon Premium Firmware Version 3.20 installed on Modicon Premium Controller

Modicon Premium Firmware All Versions installed on Modicon Premium Controller

PLC Simulator default component of EcoStruxure Control Expert Versions prior to v15.1

CWE-284: Improper Access Control vulnerability exists, which could cause a remote code execution by
overwriting configuration settings of the controller over Modbus.

CVE Description

CVSS v4.0 Base Score 10.0 | Critical | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)

CVSS v4.0 Score

Version sv4.20 of Modicon M580 includes a fix for this vulnerability and is available for download here: STEP 1: Update software and firmware. • On the engineering workstation, update to EcoStruxure Control Expert v16.0: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware • On the Modicon M580 controller, update to firmware SV4.20 or above: https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware STEP 2: Update projects in EcoStruxure™ Control Expert by: • Setting up an application password in the project properties • Changing the version of the controller firmware to match the new firmware version of the target controller STEP 3: Rebuild and transfer projects in EcoStruxure™ Control Expert: • Rebuild all current projects

Version sv3.60 of Modicon M340 includes a fix for this vulnerability and is available for download here: STEP 1: Update software and firmware • On the engineering workstation, update to EcoStruxure™ Control Expert v16.0 or later: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware • On the Modicon M340 controller, update to firmware v3.60 or above: https://www.se.com/ww/en/product-range/1468- modicon-m340/#software-and-firmware STEP 2: Update projects in EcoStruxure™ Control Expert by: • Setting up an application password in the project properties • Changing the version of the controller firmware to match the new firmware version of the target controller STEP 3: Rebuild and transfer projects in EcoStruxure™ Control Expert: • Rebuild all current projects • Transfer them to Modicon controllers

It is recommended to apply the following mitigations to reduce the risk of exploitation: • Set up an application password in the project properties • Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP • Configure the Access Control List following the recommendations of the user manuals: https://www.se.com/ww/en/download/document/EIO0000001578/ • Set up a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/ NOTE: Use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/

OR

• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350

OR

• Consider using external firewall devices such as EAGLE40-07 from Belden to establish VPN connections for M340 and M580 architectures. For more details refer to the chapter “How to protect M580 and M340 architectures with EAGLE40 using VPN”: https://www.se.com/ww/en/download/document/EIO0000001999/ • Ensure the M580 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/

NOTE: The CPU memory protection cannot be configured with M580 Hot Standby CPUs. In such cases, use IPsec encrypted communication.

It is recommended to apply the following mitigations to reduce the risk of exploitation:
• Set up an application password in the project properties
• Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
	o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
• Set up a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections for M340 & M580 architectures. For more details refer to the chapter “How to protect M580 and M340 architectures with EAGLE40 using VPN”: https://www.se.com/ww/en/download/document/EIO0000001999/

CVE-2019-6808

CWE-284: Improper Access Control vulnerability exists which could cause denial of service or potential code
execution by overwriting configuration settings of the controller over Modbus.

CVE Description

CVSS v4.0 Base Score 9.3 | Critical | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2018-7847

Reliance on Untrusted Inputs in a Security Decision

CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists which could cause invalid
information displayed in Unity Pro software.

CVE Description

CVSS v4.0 Base Score 8.7 | High | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2018-7850

CWE-248: Uncaught Exception vulnerability exists which could cause a possible Denial of Service due to
improper data integrity check when sending files to the controller over Modbus.

CVE Description

CVSS v4.0 Base Score 8.7 | High | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2018-7849

CWE-290: Authentication Bypass by Spoofing vulnerability exists which could cause an elevation of privilege
by conducting a brute force attack on Modbus parameters sent to the controller.

CVE Description

CVSS v4.0 Base Score 8.7 | High | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2018-7842

CWE-248: Uncaught Exception vulnerability exists which could cause denial of service when reading memory
blocks with an invalid data size or with an invalid data offset in the controller over Modbus.

CVE Description

CVSS v4.0 Score

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65150 [C] & 140CPU65160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU651X0_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67261 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67261_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67060 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67060_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67160_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65860 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65860_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67861 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67861_SV3.60

Please contact your Schneider Electric customer support to get Premium V3.20 firmware.
TSXP57104M [C]
TSXP57154M [C]
TSXP571634M [C]
TSXP57204M [C]
TSXP572634M [C]
TSXP57254M [C]
TSXP57304M [C]
TSXP573634M [C]
TSXP57354M [C]
TSXP574634M [C]
TSXP57454M [C]
TSXP575634M [C]
TSXP57554M [C]
TSXP576634M [C]
TSXH5724M [C]
TSXH5744M [C]

Schneider Electric’s Modicon Quantum and Quantum Safety controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 or M580 Safety ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information. To mitigate the risks associated with Modbus/ weaknesses, users should immediately: • Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP • Configure the Access Control List feature as mentioned in “Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter “Software Settings for Ethernet Communication / Messaging / Quantum NOE Ethernet Messaging Configuration”: https://www.se.com/ww/en/download/document/33002467K01000/

Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information. To mitigate the risks associated with Modbus/ weaknesses, users should immediately:
• Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP Services Configuration Parameters / Connection Configuration Parameters”: https://www.se.com/ww/en/download/document/35006192K01000/

CVE-2018-7843

CWE-125: Out-of-bounds Read vulnerability exists, which could cause the disclosure of unexpected data from
the controller when reading specific memory blocks in the controller over Modbus.

CVE Description

CVSS v4.0 Score

CVE-2018-7845

CWE-248: Uncaught Exception vulnerability exists which could cause denial of service when an invalid private
command parameter is sent to the controller over Modbus.

CVE Description

CVSS v4.0 Score

Schneider Electric's Modicon Quantum and Quantum Safety controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 or M580 Safety ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information. To mitigate the risks associated with Modbus/ weaknesses, users should immediately: • Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP • Configure the Access Control List feature as mentioned in “Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter “Software Settings for Ethernet Communication / Messaging / Quantum NOE Ethernet Messaging Configuration”: https://www.se.com/ww/en/download/document/33002467K01000/

CVE-2018-7852

CWE-248: Uncaught Exception vulnerability exists, which could cause denial of service when reading invalid
physical memory blocks in the controller over Modbus.

CVE Description

CVSS v4.0 Score

CVE-2018-7853

CWE-248 Uncaught Exception vulnerability exists which could cause a denial of Service when sending invalid
debug parameters to the controller over Modbus.

CVE Description

CVSS v4.0 Score

CVE-2018-7854

CWE-248 Uncaught Exception vulnerability exists, which could cause a Denial of Service when sending invalid
breakpoint parameters to the controller over Modbus.

CVE Description

CVSS v4.0 Score

Version sv2.90 of Modicon Momentum includes a fix for this vulnerability and is available for download here: STEP 1: Update software and firmware. • On the engineering workstation, update to EcoStruxure™ Control Expert v16.2 HF003 (https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware). • On the Modicon Momentum CPU, update to firmware v2.90: https://www.se.com/ww/en/product-range/535-modicon-momentum/#software-and-firmware STEP 2: Update projects in EcoStruxure™ Control Expert by: • Setting up an application password in the project properties • Changing the version of the controller firmware to match the new firmware version of the target controller STEP 3: Rebuild and transfer projects in EcoStruxure™ Control Expert: • Rebuild all current projects • Transfer them to Modicon controllers

To mitigate the risks associated with CVE-2018-7855, users should immediately apply the following steps:
• Set up an application password in the project properties
• Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
• “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)”: https://www.se.com/ww/en/download/document/EIO0000002071/
• Setup a secure communication according to the following guideline “Modicon Controller Systems Cybersecurity, User Guide” in chapter “Set Up Encrypted Communication”: https://www.se.com/ww/en/download/document/EIO0000001999/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploitation: To mitigate the risks associated with Modbus weaknesses, users should immediately:
• Set up an application password in the project properties
• Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual, “Momentum for EcoStruxure Control Expert - 171 CBU 78090, 171 CBU 98090, 171 CBU 98091 Processors” manual in the chapter “Modbus Messaging and Access Control”: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_Doc_Ref=HRB44124
• Set up a secure communication according to the following guideline “Modicon Controller Systems Cybersecurity, User Guide” in chapter “Set Up Encrypted Communication”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Set up a VPN between the Modicon PLC controllers and the engineering workstation containing EcoStruxure Control Expert or Process Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.

Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.

CVE-2018-7855

CWE-248: Uncaught Exception vulnerability exists which could cause a possible denial of Service when writing
invalid memory blocks to the controller over Modbus.

CVE Description

CVSS v4.0 Score

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65150 [C] & 140CPU65160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU651X0_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67261 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67261_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67060 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67060_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67160_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65860 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65860_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67861 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67861_SV3.60

Please contact your Schneider Electric customer support to get Premium V3.20 firmware.
TSXP57104M [C]
TSXP57154M [C]
TSXP571634M [C]
TSXP57204M [C]
TSXP572634M [C]
TSXP57254M [C]
TSXP57304M [C]
TSXP573634M [C]
TSXP57354M [C]
TSXP574634M [C]
TSXP57454M [C]
TSXP575634M [C]
TSXP57554M [C]
TSXP576634M [C]
TSXH5724M [C]
TSXH5744M [C]

CVE-2018-7856

CWE-248: Uncaught Exception vulnerability exists, which could cause a possible Denial of Service when
writing out of bounds variables to the controller over Modbus.

CVE Description

CVSS v4.0 Score

Version v1.80 of Modicon MC80 includes a fix for this vulnerability and is available for download here: STEP 1: Update software and firmware. • On the engineering workstation, update to EcoStruxure™ Control Expert v16.0 or later: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware • On the Modicon MC80 controller, update to firmware V1.80 or above: https://www.se.com/ww/en/product-range/62396-modicon-mc80/#software-and-firmware STEP 2: Update projects in EcoStruxure™ Control Expert by: • Setting up an application password in the project properties • Changing the version of the controller firmware to match the new firmware version of the target controller STEP 3: Rebuild and transfer projects in EcoStruxure™ Control Expert: • Rebuild all current projects • Transfer them to Modicon controllers

To mitigate the risks, users should immediately apply the following steps:
• Set up an application password in the project properties
• Set up network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
• “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)”: https://www.se.com/ww/en/download/document/EIO0000002071/
• Setup a secure communication according to the following guideline “Modicon Controller Systems Cybersecurity, User Guide” in chapter “Set Up Encrypted Communication”: https://www.se.com/ww/en/download/document/EIO0000001999/

Version v15.1 of EcoStruxure™ Control Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware

Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Ensure to use simulator default panel option to make PLC simulator accessible only locally.
• Modbus network connections are disabled by default on the PLC Simulator present in EcoStruxure™ Control Expert, mitigating the risk associated to this vulnerability.
Note: The PLC Simulator feature is part of the EcoStruxure Control Expert software, and it helps users to review and test their configurations files in a simulation environment. It is not intended to be used as a controller CPU in a production environment.

Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.

CVE-2018-7857

Exposure of Sensitive Information to an Unauthorized Actor

CWE-200: Information Exposure vulnerability exists which could cause the disclosure of SNMP information
when reading variables in the controller using Modbus.

CVE Description

CVSS v4.0 Score

CVE-2019-6806

CWE-248: Uncaught Exception vulnerability exists which could cause a possible denial of service when writing
sensitive application variables to the controller over Modbus.

CVE Description

CVSS v4.0 Score

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65150 [C] & 140CPU65160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU651X0_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67261 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67261_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67060 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67060_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67160_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65860 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65860_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67861 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67861_SV3.60

Please contact your Schneider Electric customer support to get Premium V3.20 firmware.
TSXP57104M [C]
TSXP57154M [C]
TSXP571634M [C]
TSXP57204M [C]
TSXP572634M [C]
TSXP57254M [C]
TSXP57304M [C]
TSXP573634M [C]
TSXP57354M [C]
TSXP574634M [C]
TSXP57454M [C]
TSXP575634M [C]
TSXP57554M [C]
TSXP576634M [C]
TSXH5724M [C]
TSXH5744M [C]

Version v15.1 of EcoStruxure™ Control Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware

CVE-2019-6807

CWE-248: Uncaught Exception vulnerability exists, which could cause a possible denial of service when
reading specific coils and registers in the controller over Modbus.

CVE Description

CVSS v4.0 Score

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65150 [C] & 140CPU65160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU651X0_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67261 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67261_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67060 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67060_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67160 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67160_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67260 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67260_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU65860 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU65860_SV3.60

Version v3.60 of Modicon Quantum includes a fix for this vulnerability and is available for download here:
140CPU67861 [C] - https://www.schneider-electric.com/en/download/document/Quantum_140CPU67861_SV3.60

Please contact your Schneider Electric customer support to get Premium V3.20 firmware.
TSXP57104M [C]
TSXP57154M [C]
TSXP571634M [C]
TSXP57204M [C]
TSXP572634M [C]
TSXP57254M [C]
TSXP57304M [C]
TSXP573634M [C]
TSXP57354M [C]
TSXP574634M [C]
TSXP57454M [C]
TSXP575634M [C]
TSXP57554M [C]
TSXP576634M [C]
TSXH5724M [C]
TSXH5744M [C]

CVE-2019-6828

CWE-248: Uncaught Exception vulnerability exists which could cause a possible denial of service when writing
to specific memory addresses in the controller over Modbus.

CVE Description

CVSS v4.0 Score

CVE-2019-6829

CWE-248: Uncaught Exception vulnerability exists, which could cause a possible denial of service when
reading invalid data from the controller.

CVE Description

CVSS v4.0 Score

CVE-2019-6809

CWE-200: Information Exposure vulnerability exists, which could cause the disclosure of SNMP information
when reading memory blocks from the controller over Modbus.

CVE Description

CVSS v4.0 Score

Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.

CVE-2018-7844

CWE-248: Uncaught Exception vulnerability exists, which could cause a possible denial of service when
sending an appropriately timed HTTP request to the controller.

CVE Description

CVSS v4.0 Base Score 8.2 | High | [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2019-6830

CWE-200: Information Exposure vulnerability exists, which could cause the disclosure of SNMP information
when reading files from the controller over Modbus.

CVE Description

CVSS v4.0 Base Score 8.2 | High | [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2018-7848

CWE-501: Trust Boundary Violation vulnerability on connection to the controller exists which could cause
unauthorized access by conducting a brute force attack on Modbus protocol to the controller.

CVE Description

CVSS v4.0 Base Score 6.9 | Medium | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2018-7846


Summary: Original Release

Summary: Updated Remediation and Acknowledgement sections

Summary: A fix is available for Harmony/Magelis HMIGTO series, Harmony/Magelis, HMIGTU series, Harmony/Magelis HMIGTUX series, Harmony/Magelis HMIGK series and mitigations were added to reduce the risk of exploit for the remaining affected products.

Summary: A fix is available for Harmony/Magelis HMISCU

Summary: Harmony (formerly known as Magelis) HMI Panels - SEVD-2019-225-01 PDF Version

Summary: Harmony (formerly known as Magelis) HMI Panels - SEVD-2019-225-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Harmony (formerly known as Magelis) HMI Panel products. Harmony HMI Panels are the main visible automation component that manage all vital machine features, including visualization, control, supervision, diagnostics, monitoring, and data logging.
Failure to apply the mitigations/remediations provided below may risk a temporary Denial of Service.
January 2024 Update: A fix is available for HMISCU series.

Overview

Schneider Electric

Harmony/Magelis HMIGK series

<6.2 SP11

Schneider Electric Harmony/Magelis HMIGK series Version prior to v6.2 SP11

Harmony/Magelis HMIGTO series

<6.2 SP11

Schneider Electric Harmony/Magelis HMIGTO series Version prior to v6.2 SP11

Harmony/Magelis HMISTO series

Schneider Electric Harmony/Magelis HMISTO series All versions

Harmony/Magelis) HMIGTU series

<6.2 SP11

Schneider Electric Harmony/Magelis) HMIGTU series Version prior to v6.2 SP11

Harmony/Magelis HMIGTUX series

<6.2 SP11

Schneider Electric Harmony/Magelis HMIGTUX series Version prior to v6.2 SP11

Harmony/Magelis HMIGXO series

Schneider Electric Harmony/Magelis HMIGXO series All versions

Harmony/Magelis HMIGXU series

Schneider Electric Harmony/Magelis HMIGXU series All versions

Harmony/Magelis HMISCU series

Schneider Electric Harmony/Magelis HMISCU series Version prior to v6.3.1

Harmony/Magelis HMISTU series

Schneider Electric Harmony/Magelis HMISTU series All versions

Harmony/Magelis XBTGC series

Schneider Electric Harmony/Magelis XBTGC series All versions

Harmony/Magelis XBTGH series

Schneider Electric Harmony/Magelis XBTGH series All versions

Harmony/Magelis XBTGT series

Schneider Electric Harmony/Magelis XBTGT series All versions

Harmony/Magelis HMIGK series

6.2 SP11 Multi HotFix 4

Schneider Electric Harmony/Magelis HMIGK series Version 6.2 SP11 Multi HotFix 4

Harmony/Magelis HMIGTO series

6.2 SP11 Multi HotFix 4

Schneider Electric Harmony/Magelis HMIGTO series Version 6.2 SP11 Multi HotFix 4

Harmony/Magelis HMIGTU series

6.2 SP11 Multi HotFix 4

Schneider Electric Harmony/Magelis HMIGTU series Version 6.2 SP11 Multi HotFix 4

Harmony/Magelis HMIGTUX series

6.2 SP11 Multi HotFix 4

Schneider Electric Harmony/Magelis HMIGTUX series Version 6.2 SP11 Multi HotFix 4

Harmony/Magelis HMISCU series

Schneider Electric Harmony/Magelis HMISCU series 6.3.1

CVE-2019-6833

A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists which
could cause a temporary freeze of the HMI when a high rate of frames is received. When the
attack stops, the buffered commands are processed by the HMI panel.

CVE Description

Version 6.2 SP11 Multi HotFix 4 of Vijeo Designer
includes a fix for these vulnerabilities and can be
updated through the Schneider Electric Software
Update (SESU) application.
On the engineering workstation, update to v6.2 SP11
Multi HotFix 4 (or above) of Vijeo Designer.
To complete the update, connect to Harmony HMI and
download the project file using Vijeo Designer v6.2
SP11 Multi HotFix 4.

Version 6.3.1 of Vijeo Designer includes a fix for this
vulnerability and can be updated through the Schneider
Electric Software Update (SESU) application.
https://www.se.com/ww/en/product-range/1054-vijeodesigner-
hmi-software/#software-and-firmware
On the engineering workstation, update to v6.3.1 of
Vijeo Designer.
To complete the update, connect to Harmony HMI and
download the project file using Vijeo Designer v6.3.1.

These products have reached their End of Commercialization.
Customers should immediately apply the following mitigations below the table to reduce the risk of exploit or contact your Schneider Electric Customer Support to obtain its successor.
• Vijeo Designer v6.2 SP10 release includes the ability to disable the FTP Server (this is the behavior by default).
o For customers using Vijeo Designer version v6.1 or earlier, please contact your Schneider Electric Customer Support to obtain the latest version of Vijeo Designer.
o For customers using a version of Vijeo Designer v6.2 or greater, Vijeo Designer 6.2 SP10 will be automatically available in Schneider Electric Software Update (SESU) software.
• Customers are urged to follow the Recommended Cybersecurity Best Practices and to
deactivate the FTP server.
• Customers are also strongly encouraged to implement the following workarounds and
mitigations to reduce the risk:
o Setup network segmentation and implement a firewall to block all unauthorized access to ports 44818/TCP, 502/TCP, 6000/TCP, 6002/TCP, 8080/TCP, 8014/TCP, and 6001/TCP.


Modicon Controllers

Summary: Original Release

Summary: Fix now available for M580 firmware version 3.10 for CVE-2019-6841, CVE-2019-6843, CVE-2019-6844

Summary:
Updated CWE for:
• CVE-2019-6841
• CVE-2019-6842
• CVE-2019-6843
• CVE-2019-6844
• CVE-2019-6847

Summary: A fix is available in Modicon M580 V4.02 that addresses vulnerabilities related to FTP. The FTP protocol was previously required during firmware upgrade process, and it has been replaced by HTTPS protocol.

Summary: The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

Summary: A clarification was added to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 V4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document

Summary: The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

Summary: Remediation for the Modicon M580 CPU Safety is available for download (page 4).

Summary: Modicon Controllers - SEVD-2019-281-02 PDF Version

Summary: Modicon Controllers - SEVD-2019-281-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Modicon Controller products.
March 2023 Update: Remediation for the Modicon M580 CPU is available for download

Overview

M580 V4.02 Firmware

BMEP584040	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEH584040 and C	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP586040 and C	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEH586040 and C	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP581020 and H	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP582020 and H	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP582040 and H	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP583020	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP583040	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP584020	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP585040 and C	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEH582040 and C	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEP584040S	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEH584040S	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

BMEH586040S	https://www.se.com/us/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware

Links to M580 V4.02 Firmware

Schneider Electric

Modicon M580

Schneider Electric Modicon M580 prior to 4.02

Schneider Electric Modicon M580 prior to 4.10

Schneider Electric Modicon M580 All versions

Modicon M340

Schneider Electric Modicon M340 All versions

Modicon BMxCRA and 140CRA modules

Schneider Electric Modicon BMxCRA and 140CRA modules All versions

Modicon M580

Schneider Electric Modicon M580 All Versions

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S & BMEH58*S) Versions prior to SV4.21

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S & BMEH58*S) Versions SV4.21

CVE-2019-6841

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a Denial of Service of the controller when upgrading the firmware with no firmware image inside the package using FTP protocol.

CVE Description

Firmware SV4.21 includes a fix for these vulnerabilities and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac-controller/#software-and-firmware
 Important: customer needs to use version of EcoStruxure™
Control Expert V16.0 HF001 minimum to connect with the latest
version of M580 CPU Safety. The software is available for
download here: tps://www.se.com/ww/en/product-range/548-ecostruxurecontrol-expert-unity-pro/#software-and-firmware

Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. For specific questions or support, Customers are requested to contact Schneider Electric’s Customer Care Center.
Customers should immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers
• Deactivate the FTP service when not needed using Unity Pro / Control Expert software
• Change the default FTP password (this procedure should also be applied after each firmware upgrade of the controller) using Unity / Control Expert in the following menu:
“Project Properties / Protection”
• When upgrading a firmware in the controller make sure that the firmware downloaded is compatible with the application already available in the controller. If not the case, use Unity Pro / Control Expert software to rebuild the application of your controller.
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, in chapter “Setup secured communications”:
https://www.schneider-electric.com/en/download/document/EIO0000001999/
• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
• To remove the confidentiality issue from FTP protocol, use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
https://www.schneider-electric.com/en/download/document/HRB62665/
• Ensure the CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication
To further reduce the attack surface on Modicon M580 CPU Safety:
• Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

If If customers choose not to apply the remediation then they are encouraged
• Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers
• Deactivate the FTP service when not needed using Unity Pro / Control Expert software
• Change the default FTP password (this procedure should also be applied after each firmware upgrade of the controller) using Unity / Control Expert in the following menu:
“Project Properties / Protection”
• When upgrading a firmware in the controller make sure that the firmware downloaded is compatible with the application already available in the controller. If not the case, use Unity Pro / Control Expert software to rebuild the application of your controller.
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, in chapter “Setup secured communications”:
https://www.schneider-electric.com/en/download/document/EIO0000001999/
• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
• To remove the confidentiality issue from FTP protocol, use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
https://www.schneider-electric.com/en/download/document/HRB62665/
• Ensure the CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication
To further reduce the attack surface on Modicon M580 CPU Safety:
• Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

Version 3.50 of Modicon M340 includes a fix for the vulnerability and is available for download here: https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/
Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers
• Deactivate the FTP service when not needed.
• Change the default FTP password (this procedure should also be applied after each firmware upgrade of the controller) using Unity / Control Expert in the following menu: “Project Properties / Protection”
• When upgrading a firmware in the controller make sure that the firmware downloaded is compatible with the application already available in the controller. If not the case, use Unity Pro / Control Expert software to rebuild the application of your controller.

To mitigate the risks associated to the FTP weaknesses, users should immediately apply the following instructions.
• Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.

Firmware SV4.10 includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/
If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
•Setup network segmentation and implement a firewall to block allunauthorized access to FTP port 21/TCP on the controllers
•Deactivate the FTP service when not needed using Unity Pro /Control Expert software
•Change the default FTP password (this procedure should also beapplied after each firmware upgrade of the controller) using Unity /Control Expert in the following menu:
“Project Properties / Protection”
•When upgrading a firmware in the controller make sure that thefirmware downloaded is compatible with the application alreadyavailable in the controller. If not the case, use Unity Pro / ControlExpert software to rebuild the application of your controller.
•Setup a secure communication according to the followingguideline “Modicon Controllers Platform Cyber SecurityReference Manual”, in chapter “Setup securedcommunications”:
https://www.schneider-electric.com/en/download/document/EIO0000001999/
•Use a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter “Configuringthe BMENUA0100 Cybersecurity Settings”:https://www.se.com/ww/en/download/document/PHA83350
•To remove the confidentiality issue from FTP protocol, use aBMENOC module and follow the instructions to configure IPSECfeature as described in the guideline “Modicon M580 -BMENOC03.1 Ethernet Communications Module, Installation andConfiguration Guide” in the chapter “Configuring IPSECcommunications”:https://www.schneider-electric.com/en/download/document/HRB62665/
•Ensure the CPU is running with the memory protection activated byconfiguring the input bit to a physical input, for more details refer tothe following guideline “Modicon Controllers Platform CyberSecurity Reference Manual”, “CPU Memory Protection section”:https://www.schneider-electric.com/en/download/document/EIO0000001999/
oNOTE: The CPU memory protection cannot be configuredwith Hot Standby CPUs. In such cases, use IPsec encryptedcommunication

CVE-2019-6842

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a Denial of Service of the controller when upgrading the firmware with a missing web server image inside the package using FTP protocol.

CVE Description

CVE-2019-6843

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a Denial of Service of the controller when upgrading the controller with an empty firmware package using FTP protocol.

CVE Description

CVE-2019-6844

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a Denial of Service of the controller when upgrading the controller with a firmware package containing an invalid web server image using FTP protocol.

CVE Description

CVE-2019-6847

A CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a Denial of Service of the FTP service when upgrading the firmware with a version incompatible with the application in the controller using the FTP protocol.

CVE Description

CVE-2019-6846

A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could cause an information disclosure when using the FTP protocol.

CVE Description


MSX Configurator

Summary: Original Release

Summary: MSX Configurator - SEVD-2020-014-01 PDF Version

Summary: MSX Configurator - SEVD-2020-014-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the MSX Configurator product.

Overview

Schneider Electric

MSX Configurator software

Schneider Electric MSX Configurator software prior to V1.0.8.1

Schneider Electric MSX Configurator software  V1.0.8.1

CVE-2019-6858

A CWE-427:Uncontrolled Search Path Element vulnerability exists which could cause privilege
escalation when injecting a malicious DLL.

CVE Description

This vulnerability is fixed in version V1.0.8.1 MSX Configurator software and is available for
download below:
https://www.se.com/ww/en/download/document/MSX+Configurator/


Summary: Original Release

Summary: ProSoft Configurator for Modicon PMEPXM0100 (H) - SEVD-2020-042-01 PDF Version

Summary: ProSoft Configurator for Modicon PMEPXM0100 (H) - SEVD-2020-042-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the ProSoft Configurator for the PMEPXM0100
(H) module.

Overview

Schneider Electric

ProSoft Configurator

Schneider Electric ProSoft Configurator v1.002 and prior

Schneider Electric ProSoft Configurator v1.003

CVE-2020-7474

A CWE-427: Uncontrolled Search Path Element vulnerability exists which could cause the
execution of untrusted code when using double click to open a project file which may trigger
execution of a malicious DLL.

CVE Description

This vulnerability is fixed in ProSoft Configurator v1.003 and is available for download below:
https://www.se.com/ww/en/download/document/PMEPXM0100_PCM/
or access the latest version in the “Software and Firmware” section using the link below:
https://www.se.com/ww/en/product/PMEPXM0100/modicon-m580-profibus-dp-master-module/


Summary: Original Release

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2020-070-01 PDF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2020-070-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the IGSS product.

Overview

Schneider Electric

IGSS using the service: IGSSupdate

Schneider Electric IGSS using the service: IGSSupdate version 14 and prior

Schneider Electric IGSS 14 v14.0.0.20009

CVE-2020-7479

A CWE-306: Missing Authentication for Critical Function vulnerability exists which could allow a
local user to execute processes that otherwise require escalation privileges when sending local
network commands to the IGSS Update Service.

CVE Description

These vulnerabilities are fixed in IGSS14 version 14.0.0.20009 and the update is available for
download below:
http://igss.schneider-electric.com/igss/igssupdates/v140/IGSSUPDATE.zip
For IGSS version 13 and prior we recommend updating to IGSS version 14.

Alternatively, the following workarounds and mitigations can be applied by customers to reduce
the risk:
• Disable the IGSS Update service when it is not required installing updates using the
service.
• Keep the infrastructure offline and do not allow Windows login and network access for
untrusted people and sources.

CVE-2020-7478

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists which could allow
a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an
unrestricted or shared network when the IGSS Update Service is enabled.

CVE Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')


Modicon Quantum Ethernet Network module and Quantum / Premium COPRO

Summary: Original Release

Summary: Modicon Quantum Ethernet Network module and - SEVD-2020-070-02 PDF Version

Summary: Modicon Quantum Ethernet Network module and - SEVD-2020-070-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Quantum Ethernet Network module and
Quantum/Premium COPRO.

Overview

Schneider Electric Quantum processors with integrated Ethernet - 140CPU65xxxxx all versions

Schneider Electric Quantum Ethernet Network module 140NOE771x1 version 7.0 and prior

Schneider Electric Premium processors with integrated Ethernet all versions

Schneider Electric Quantum Ethernet Network module 140NOE77101 v7.1

Schneider Electric Quantum Ethernet Network module 140NOE77111 v7.1

CVE-2020-7477

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which
could cause a Denial of Service when sending a specially crafted command over Modbus.

CVE Description

China Information Technology Security Evaluation Centre (CNITSEC)

Quantum Ethernet Network module 140NOE771x1
This vulnerability is fixed in version 7.1 and is available for download below:
• 140NOE77101:
https://www.se.com/ww/en/download/document/140NOE77101+Exec+and+Release+Notes/

Quantum Ethernet Network module 140NOE771x1
This vulnerability is fixed in version 7.1 and is available for download below: 140NOE77111:
https://www.se.com/ww/en/download/document/140NOE77111+Exec+and+Release+Notes+For+
Unity+and+Non+Unity+Users/

Quantum / Premium COPRO
Schneider Electric’s Modicon Quantum / Premium controllers have reached their end of life and
are no longer commercially available. They have been replaced by the Modicon M580 ePAC
controller, our current product offer. Customers should strongly consider migrating to the
ModiconM580 ePAC. Please contact your local Schneider Electric technical support for more
information.
To mitigate the risks associated with this vulnerability, users should immediately:
• Setup network segmentation and implement a firewall to block all
unauthorized access to port TCP/502

 Quantum:
• Configure the Access Control List feature as mentioned in “Quantum
using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in
chapter “Software Settings for Ethernet Communication / Messaging / Quantum
NOE Ethernet Messaging Configuration”:
https://www.schneider-electric.com/en/download/document/33002467K01000/

Quantum / Premium COPRO
Schneider Electric’s Modicon Quantum / Premium controllers have reached their end of life and
are no longer commercially available. They have been replaced by the Modicon M580 ePAC
controller, our current product offer. Customers should strongly consider migrating to the
ModiconM580 ePAC. Please contact your local Schneider Electric technical support for more
information.
To mitigate the risks associated with this vulnerability, users should immediately:
• Setup network segmentation and implement a firewall to block all
unauthorized access to port TCP/502

 Premium:
• Configure the Access Control List following the recommendations of the user
manual “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet
Network Modules, User Manual” in chapters “Connection configuration parameters /
TCP/IP Services Configuration Parameters / Connection Configuration Parameters”:
https://www.schneider-electric.com/en/download/document/35006192K01000/


ZigBee Installation Toolkit

Summary: Original Release

Summary: ZigBee Installation Toolkit - SEVD-2020-070-03 PDF Version

Summary: ZigBee Installation Toolkit - SEVD-2020-070-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the ZigBee Installation Toolkit product.

Overview

Schneider Electric

ZigBee Installation Kit

Schneider Electric ZigBee Installation Kit versions prior to 1.0.1

Schneider Electric ZigBee Installation Kit version 1.0.1

CVE-2020-7476

A CWE-426: Untrusted Search Path vulnerability exists which could cause execution of
malicious code when a malicious file is put in the search path.

CVE Description

This vulnerability is fixed in version 1.0.1 and is available for download below:
https://www.se.com/ww/en/product-range-download/2723-ulti/#/software-firmware-tab

The following workarounds and mitigations can be applied by customers to reduce the risk:
• Updated anti-virus program
• Secure computer to prevent unauthorized users and unauthorized files


Andover Continuum System

Summary: Original Release

Summary:
Revised overview, affected products, vulnerability
details, and remediation for clarification (page 1-2)

Summary:
Minor updates to overview, vulnerability details,
and product information for clarification (page 1-2)

Summary: Andover Continuum System - SEVD-2020-070-04 PDF Version

Summary: Andover Continuum System - SEVD-2020-070-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Andover Continuum product line.
Andover Continuum allows users to view and control functions of the Continuum system.

Overview

Schneider Electric

Andover Continuum

vers.all/*

Schneider Electric Andover Continuum All Versions

CVE-2020-7480

Continuum XML Vulnerability – The CyberStation product uses the MS-XML version 4.0 library.
Issues in this Microsoft functionality may leave CyberStation open to attack.
A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists which
could cause files on the application server filesystem to be viewable when an attacker interferes
with an application's processing of XML data.

CVE Description

Andover Continuum is a classic Schneider Electric product line. New projects are utilizing our
more modern, secure and feature rich platform, EcoStruxure Building Operation. For customers
with active Continuum installations, Schneider Electric continues to provide resources in a
support function where we continue to support the platform per our BMS support policy as these
sites work towards transition and modernization to EcoStruxure Building Operation. Given the
clear path to EcoStruxure Building Operation and available alternatives to these specific issues,
we will not provide a patch for this issue. To reduce risk until modernization to EcoStruxure
Building, it is strongly recommended that customers use the methods below:
• It is strongly recommended that the Continuum system be installed on an isolated
network segment.
• Compensating controls could include, but not limited to, incorporating firewalls with
access control lists, deep packet inspection and packet filtering.

CVE-2020-7481

Continuum XSS Vulnerability – The web.Client has a Cross Site Scripting (XSS) vulnerability
that may expose the user to various possible attacks.
A CWE-79:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
vulnerability exists which could enable a successful “Cross-site Scripting” (XSS attack) when
using the products’ web server.

CVE Description