Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of multiple memory allocation vulnerabilities dubbed 'BadAlloc', disclosed by
Microsoft on April 29, 2021. The impact of a successful exploitation of the vulnerabilities may result in denial of
service, or remote code execution, depending on the context.

September 2025 Update: Corrected and updated affected versions for EPC2000, EPC3000, Eurotherm E+PLC400, Eurotherm Eycon 10/20 Visual Supervisor, Eurotherm T2550 PAC, and Eurotherm T2750 PAC.

Overview

The complete list of affected real-time operating systems can be found here: https://us-cert.cisa.gov/ics/advisories/icsa-21-119-04

Vulnerability Details

Schneider Electric has determined that the following offers are impacted and has provided remediations, for
those listed in the Available Remediations section, and recommended mitigations, for those in the Affected
Products section.
Please subscribe to the Schneider Electric security notification service to be informed of critical updates to this
notification, including information on affected products and remediation plans:
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp

Affected Products, Remediations & Mitigations

Summary: BadAlloc Vulnerabilities - SEVD-2021-313-05 CSAF Version

Summary: BadAlloc Vulnerabilities - SEVD-2021-313-05 PDF Version

BadAlloc Vulnerabilities

Summary: Original Release

Summary:
Fixed version number of PacDrive Eco/Pro/Pro2 Logic Controllers
corrected to v1.66.5.1.

Summary:
Remediations added for SCD6000 Industrial RTU, PowerLogic
ION7400, PowerLogic ION8000, PowerLogic ION9000. Upon further
investigation Tricon Communication Modules have been removed from
list of affected products and are not impacted by the Badalloc
Vulnerabilities.

Summary: Remediations added for PowerLogic ION9000.

Summary:
Remediations added for Easergy P5, EPC3000, Harmony/ Magelis
HMIGTU Series, HMIGTUX Series, HMIGK Series, nanodac, Pro-face
SP-5B00, SP-5B10,SP-5B90,ST6000 Series (GP-ProEX model),
ET6000 Series in the Available Remediations section (page 1, 2, 4, and
6). Updated versions affected to all versions for Pro-face GP4000
Series, LT4000M Series, GP4000H Series in the Affected Versions
section.

Summary:
Moved back to affected products section: Harmony/ Magelis HMIGTU
Series, HMIGTUX Series, HMIGK Series.

Summary:
Available remediations for Easy Harmony ET6 (HMIET Series), Easy
Harmony GXU (HMIGXU Series), Harmony/ Magelis (HMIGTU Series,
HMIGTUX Series, HMIGK Series), Modicon M262 Logic Controllers,
and Modicon M241/M251 Logic Controllers. Added Easergy MiCOM
P30 and Easergy MiCOM P40 to the list of affected products.

Summary:
Added remediations for Eurotherm E+PLC400, Eurotherm T2750 PAC
and Modicon M340 CPU. Additionally, Eurotherm T2550 PAC and
Eurotherm Eycon 10/20 Visual Supervisor have been added as affected
products to this security notification in the remediation section.

Summary:
Added a remediation for HMISCU, added the following affected models
to the Easergy MiCOM P30 range: C434, P132, P139, P433, P435,
P437, P532, P631, P632, P633, P634, Px36/8.

Summary: Added a remediation for EPC2000, v4.03 includes a fix.

Summary:
Remediation added for Versadac. The previously added remediation for
EPC2000 has been removed as v4.03 is not yet available, this
document will be updated when it is released.

Summary:
Remediations available for Modicon M580 CPU (BMEP* and BMEH*)
and Pro-face GP4000 Series, GP4000H Series GP-Pro EX.

Summary:
Final Remediations available for Modicon M340 Modules
BMXNOC0401 and BMXNOR0200H RTU, and Modicon MC80
Controller (BMKC8*). There is a mitigation available for Profibus
Remote Master (TCSEGPA23F14F) and CANopen X80
Communication Module (BMECXM0100).

Summary:
Easergy MiCOM P30 range P632 and P633 were added as affected
models along with a remediation. Final mitigations were added for
Modicon Momentum ENT. Adding a clarification to the list of affected
products by splitting Modicon M580 and Modicon M580 Safety CPU
ranges; the latest fix Modicon M580 v4.02 does not apply to the Safety
range of M580.

Summary: A remediation is now available for EPC2000.

Summary:
The Modicon M580 SV4.02 firmware has been retracted for quality
issues and is no longer available for download. Additional mitigations
have been introduced for Modicon M580 CPU and M580 CPU Safety,
and we urge customers to deploy these mitigations to further reduce
the risk of potential exploitation of identified vulnerabilities.

Summary:
There are remediations available for Easergy MiCOM P30 range and
Pro-face LT4000M Series.

Summary:
There is a remediation for Modicon M340 Ethernet Communication
Modules BMXNOE0100 (H) and BMXNOE0110 (H) products.

Summary:
Remediations for the following products are now available: Easergy
MiCOM P30 range models P139, P437, P439, P532, P631, P632,
P633, P634, C434 (page 2), Modicon M580 CPU part numbers BMEP*
and BMEH (page 7), and Modicon Momentum Unity M1E Processor
part numbers 171CBU* (page 8). Mitigations for Easergy MiCOM P30
range, models P138, P436, P438, P132, P433, P435 have been added.

Summary:
Remediations are now available for Modicon M580 Ethernet
Communication Modules BMENOC*.

Summary:
A remediation is now available for Modicon X80 Module (part number
BMXNOM0200).

Summary:
A remediation is now available for HART IO X80 Module (part number
BMEAHI0812, BMEAHO0412).

Summary:
Easergy MiCOM P30 range models 139 and 436 were added to
Affected Products.

Summary: A remediation is available on Modicon M580 CPU Safety.

Summary: A remediation is available on HMISTU (page 4).

Summary:
Changes have been made to the Easergy MiCOM P30 remediation
description and we have added model P638 to the list of Easergy
MiCOM P30s with a remediation.

Summary:
A remediation is available for Modicon X80 module, part number
BMENOS0300 (Page 10).

Summary:
A remediation is available for BMECRA31210, BMXCRA31200,
BMXCRA31210 (Page 13) and mitigations for this product have been
updated.

Summary:
Remediations are available for 140CRA31200 (Quantum RIO Drop),
140CRA31908 (M580 Quantum S908 RIO Drop Adapter) (Page 13),
and BMENOP0300 (Page 14).

Summary: Corrected and updated affected versions for EPC2000, EPC3000, Eurotherm E+PLC400, Eurotherm Eycon 10/20 Visual Supervisor, Eurotherm T2550 PAC, and Eurotherm T2750 PAC.

Schneider Electric

Easergy

Schneider Electric Easergy C5x Versions prior to 1.0.5

Schneider Electric Easergy C5x Version 1.0.5

Easergy MiCOM P30

Schneider Electric Easergy MiCOM P30 v660 to v674

Schneider Electric Easergy MiCOM P30 Version 675 and later

Schneider Electric Easergy MiCOM P30 Version 676.701

Easergy P5

Schneider Electric Easergy P5 Versions prior to 01.401.101

Schneider Electric Easergy P5 Version 01.401.101

Eurotherm

Schneider Electric Eurotherm EPC2000 Versions prior to v4.03

Schneider Electric Eurotherm EPC2000 Version 4.03

Schneider Electric Eurotherm EPC3000 Versions prior to v5.20

Schneider Electric Eurotherm EPC3000 Version 5.20

Schneider Electric Eurotherm E+PLC100 All Versions

Schneider Electric Eurotherm E+PLC400 Versions prior to v1.4.0.0

Schneider Electric Eurotherm E+PLC400 Version 1.4.0.0

Eycon 10/20 Visual Supervisor

Schneider Electric Eurotherm Eycon 10/20 Visual Supervisor Versions prior to 7.3

Schneider Electric Eurotherm Eycon 10/20 Visual Supervisor Version 7.3

T2550 PAC

Schneider Electric Eurotherm T2550 PAC Versions prior to 8.2

Schneider Electric Eurotherm T2550 PAC Version 8.2

T2750 PAC

Schneider Electric Eurotherm T2750 PAC Versions prior to 6.3

Schneider Electric Eurotherm T2750 PAC Version 6.3

nanodac

Schneider Electric Eurotherm nanodac Versions prior to 10.02

Schneider Electric Eurotherm nanodac Version 10.02

Versadac Scalable Data Recorder

Schneider Electric Eurotherm Versadac Scalable Data Recorder Versions prior to 2.43

Schneider Electric Eurotherm Versadac Version 2.43

Schneider Electric Eurotherm 6100A All Versions

Schneider Electric Eurotherm 6180A All Versions

Schneider Electric Eurotherm 6100XIO All Versions

Schneider Electric Eurotherm 6180XIO All Versions

AeroDAQ

Schneider Electric Eurotherm AeroDAQ All Versions

Vijeo Designer Basic

Schneider Electric Vijeo Designer Basic Versions prior to 1.2.1

Schneider Electric Vijeo Designer Basic Version 1.2.1

Easy Harmony

ET6 (HMIET Series)

Schneider Electric Easy Harmony ET6 (HMIET Series)

GXU (HMIGXU Series)

Schneider Electric Easy Harmony GXU (HMIGXU Series)

Vijeo Designer

<6.2 SP11 Multi HotFix 4

Schneider Electric Vijeo Designer Versions prior to 6.2 SP11 Multi HotFix 4

6.2 SP11 Multi HotFix 4

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4

>=6.2 SP11 Multi HotFix 4

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4 (or above)

<6.2 SP12

Schneider Electric Vijeo Designer Versions prior to 6.2 SP12

6.2 SP12

Schneider Electric Vijeo Designer Version 6.2 SP12

>=6.2 SP12

Schneider Electric Vijeo Designer Versions 6.2 SP12 (or above)

<6.3 SP1

Schneider Electric Vijeo Designer Versions prior to v6.3 SP1

6.3 SP1

Schneider Electric Vijeo Designer Version 6.3 SP1

>=6.3 SP1

Schneider Electric Vijeo Designer Version 6.3 SP1 (or above)

Harmony/ Magelis

HMIGTU Series

Schneider Electric Harmony/ Magelis HMIGTU Series

HMIGTUX Series

Schneider Electric Harmony/ Magelis HMIGTUX Series

HMIGK Series

Schneider Electric Harmony/ Magelis HMIGK Series

Niagara Framework

Schneider Electric Niagara Framework Versions prior to v4.10u1

Schneider Electric Niagara Framework Version 4.10u1

MiCOM C264

Schneider Electric MiCOM C264 Versions greater than or equal to B5.x and prior to B5.118

Schneider Electric MiCOM C264 Version B5.118

Schneider Electric MiCOM C264 Versions greater than or equal to D1.x and prior to D1.92

Schneider Electric MiCOM C264 Version D1.92

Schneider Electric MiCOM C264 Versions greater than or equal to D4.x and prior to D4.38

Schneider Electric MiCOM C264 Version D4.38

Schneider Electric MiCOM C264 Versions greater than or equal to D5.x and prior to D5.25I

Schneider Electric MiCOM C264 Version D5.25I

Schneider Electric MiCOM C264 Versions greater than or equal to D6.x and prior to D6.18

Schneider Electric MiCOM C264 Version D6.18

Modicon M241 Logic Controllers

Schneider Electric Modicon M241 Logic Controllers Versions prior to 5.1.9.34

Schneider Electric Modicon M241 Logic Controllers Version 5.1.9.34 or greater

Modicon M251 Logic Controllers

Schneider Electric Modicon M251 Logic Controllers Versions prior to 5.1.9.34

Schneider Electric Modicon M251 Logic Controllers Version 5.1.9.34 or greater

Modicon M262 Logic Controllers

Schneider Electric Modicon M262 Logic Controllers Versions prior to 5.1.6.1

Schneider Electric Modicon M262 Logic Controllers Version 5.1.6.1 or greater

Modicon M258 Logic Controllers

Schneider Electric Modicon M258 Logic Controllers Versions prior to 5.0.4.18

Schneider Electric Modicon M258 Logic Controllers Version 5.0.4.18

Modicon LMC058 Logic Controllers

Schneider Electric Modicon LMC058 Logic Controllers Versions prior to 5.0.4.18

Schneider Electric Modicon LMC058 Logic Controllers Version 5.0.4.18

Modicon M340 Module

Schneider Electric Modicon M340 Module BMXNOC0401 Versions prior to v2.11

Schneider Electric Modicon M340 Module BMXNOC0401 Version v2.11

BMXNOR0200 (H) RTU

<1.7 IR24

Schneider Electric Modicon M340 Module BMXNOR0200 (H) RTU Versions prior to v1.7 IR24

1.7 IR24

Schneider Electric Modicon M340 Module BMXNOR0200 (H) RTU Version 1.7 IR24

BMXNOE0100 (H)

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOE0100 (H) Versions prior to SV3.50

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOE0100 (H) Version SV3.50

BMXNOE0110 (H)

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOE0110 (H) Versions prior to SV6.70

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOE0110 (H) Version SV6.70

Modicon M340 Ethernet Communication Modules

Modicon M340 CPU

Schneider Electric Modicon M340 CPU Versions prior to 3.50

Schneider Electric Modicon M340 CPU Version 3.50

Modicon M580 CPU

Schneider Electric Modicon M580 CPU Versions prior to SV4.10

Schneider Electric Modicon M580 CPU Version SV4.10

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety Versions prior to SV4.21

Schneider Electric Modicon M580 CPU Safety Version SV4.21

EcoStruxure™ Control Expert

>=16.0 HF001

Schneider Electric EcoStruxure™ Control Expert Versions greater than or equal to 16.0 HF001

Schneider Electric Modicon M580 Ethernet Communication Modules BMENOC0301 Versions prior to SV2.21

Schneider Electric Modicon M580 Ethernet Communication Modules BMENOC0301 Version SV2.21

Schneider Electric Modicon M580 Ethernet Communication Modules BMENOC0311 Versions prior to SV2.21

Schneider Electric Modicon M580 Ethernet Communication Modules BMENOC0311 Version SV2.21

Modicon M580 Ethernet Communication Modules

Modicon M580 NOC Control

Schneider Electric Modicon M580 NOC Control BMENOC0321 Versions prior to SV1.09

Schneider Electric Modicon M580 NOC Control BMENOC0321 Version SV1.09

HART IO X80 Module

Schneider Electric HART X80 Module BMEAHI0812 Versions prior to SV1.5

Schneider Electric HART X80 Module BMEAHI0812 Version SV1.5

Schneider Electric HART X80 Module BMEAHO0412 Versions prior to SV1.5

Schneider Electric HART X80 Module BMEAHO0412 Version SV1.5

Modicon MC80 Controller

Schneider Electric Modicon MC80 Controller Versions prior to v1.8

Schneider Electric Modicon MC80 Controller Version v1.8

Modicon Momentum ENT

Schneider Electric Modicon Momentum ENT All Versions

Modicon Momentum Unity M1E Processor

Schneider Electric Modicon Momentum Unity M1E Processor Versions prior to SV2.6

Schneider Electric Modicon Momentum Unity M1E Processor Version SV2.6

Schneider Electric Modicon Quantum CPU and Communication Modules All Versions

Modicon Quantum CPU and Communication Modules

Schneider Electric Modicon Premium CPU and Communication Modules All Versions

Modicon Premium CPU and Communication Modules

Modicon X80 Module

Schneider Electric Modicon X80 Module BMXNOM0200 Versions prior to v1.60

Schneider Electric Modicon X80 Module BMXNOM0200 Version 1.60

Schneider Electric Modicon X80 Module BMENOS0300 Versions prior to v1.04

Schneider Electric Modicon X80 Module BMENOS0300 Version 1.04

PacDrive

PacDrive Eco Logic Controllers

Schneider Electric PacDrive Eco Logic Controllers Versions prior to 1.66.5.1

Schneider Electric PacDrive Eco Logic Controllers Version 1.66.5.1

PacDrive Pro Logic Controllers

Schneider Electric PacDrive Pro Logic Controllers Versions prior to 1.66.5.1

Schneider Electric PacDrive Pro Logic Controllers Version 1.66.5.1

PacDrive Pro2 Logic Controllers

Schneider Electric PacDrive Pro2 Logic Controllers Versions prior to 1.66.5.1

Schneider Electric PacDrive Pro2 Logic Controllers Version 1.66.5.1

PacDrive M Logic Controller

Schneider Electric PacDrive M Logic Controller All Versions

PowerLogic

Schneider Electric PowerLogic ION7400 Versions prior to v3.1

Schneider Electric PowerLogic ION7400 Version 3.1

Schneider Electric PowerLogic PM8000 Versions prior to v3.1

Schneider Electric PowerLogic PM8000 Version 3.1

Schneider Electric PowerLogic ION9000 Versions prior to v3.1

Schneider Electric PowerLogic ION9000 Version 3.1

Pro-face

GP-Pro EX

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.350

Schneider Electric Pro-face GP-Pro EX Version 4.09.350 or later

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.450

Schneider Electric Pro-face GP-Pro EX Version 4.09.450 or later

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.400

Schneider Electric Pro-face GP-Pro EX Version 4.09.400 or later

ST6000 Series

Schneider Electric Pro-face ST6000 Series (GP-ProEX model)

ET6000 Series

Schneider Electric Pro-face ET6000 Series

LT4000M Series

Schneider Electric Pro-face LT4000M Series

GP4000 Series

Schneider Electric Pro-face GP4000 Series

GP4000H Series

Schneider Electric Pro-face GP4000H Series

GP4100 Series

Schneider Electric Pro-face GP4100 Series All Versions

GP4000E Series

Schneider Electric Pro-face GP4000E Series All Versions

GP4000M Series

Schneider Electric Pro-face GP4000M Series All Versions

Profibus Remote Master

Schneider Electric Profibus Remote Master TCSEGPA23F14F All Versions

Schneider Electric Profibus Remote Master BMECXM0100 All Versions

SCD6000 Industrial RTU

Schneider Electric SCD6000 Industrial RTU Versions prior to SY-1101207_N

Schneider Electric SCD6000 Industrial RTU Version SY-1101207_N

SAGE RTU CPU C3414

Schneider Electric SAGE RTU CPU C3414 Versions prior to C3414-500-S02K5_P5

Schneider Electric SAGE RTU CPU C3414 Version C3414-500-S02K5_P5

Schneider Electric BMECRA31210 Versions prior to SV02.80

Schneider Electric BMECRA31210 Version SV02.80

Schneider Electric BMXCRA31200 Versions prior to SV02.80

Schneider Electric BMXCRA31200 Version SV02.80

Schneider Electric BMXCRA31210 Versions prior to SV02.80

Schneider Electric BMXCRA31210 Version SV02.80

140CRA31200 (Quantum RIO Drop)

Schneider Electric 140CRA31200 (Quantum RIO Drop) Versions prior to V02.80

Schneider Electric 140CRA31200 (Quantum RIO Drop) Version 02.80

Schneider Electric 140CRA31908 (M580 Quantum S908 RIO Drop Adapter) Versions prior to V02.80

Schneider Electric 140CRA31908 (M580 Quantum S908 RIO Drop Adapter) Version 02.80

140CRA31908 (M580 Quantum S908 RIO Drop Adapter)

Schneider Electric BMENOP0300 Versions prior to SV2.6

Schneider Electric BMENOP0300 Version SV2.6

Schneider Electric BMXNGD0100 All Versions

Easergy MiCOM P40

Schneider Electric Easergy MiCOM P40 All Versions

HMISTO5 Series

Schneider Electric HMISTO5 Series All Versions

Modicon LMC078

Schneider Electric Modicon LMC078 All Versions

Schneider Electric Vijeo Designer Basic Versions prior to 1.2.1 installed on Schneider Electric Easy Harmony ET6 (HMIET Series)

Schneider Electric Vijeo Designer Basic Version 1.2.1 installed on Schneider Electric Easy Harmony ET6 (HMIET Series)

Schneider Electric Vijeo Designer Basic Versions prior to 1.2.1 installed on Schneider Electric Easy Harmony GXU (HMIGXU Series)

Schneider Electric Vijeo Designer Basic Version 1.2.1 installed on Schneider Electric Easy Harmony GXU (HMIGXU Series)

Schneider Electric Vijeo Designer Versions prior to 6.2 SP11 Multi HotFix 4 installed on Schneider Electric Harmony/ Magelis HMIGTU Series

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4 installed on Schneider Electric Harmony/ Magelis HMIGTU Series

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4 (or above) installed on Schneider Electric Harmony/ Magelis HMIGTU Series

Schneider Electric Vijeo Designer Versions prior to 6.2 SP11 Multi HotFix 4 installed on Schneider Electric Harmony/ Magelis HMIGTUX Series

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4 installed on Schneider Electric Harmony/ Magelis HMIGTUX Series

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4 (or above) installed on Schneider Electric Harmony/ Magelis HMIGTUX Series

Schneider Electric Vijeo Designer Versions prior to 6.2 SP11 Multi HotFix 4 installed on Schneider Electric Harmony/ Magelis HMIGK Series

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4 installed on Schneider Electric Harmony/ Magelis HMIGK Series

Schneider Electric Vijeo Designer Version 6.2 SP11 Multi HotFix 4 (or above) installed on Schneider Electric Harmony/ Magelis HMIGK Series

Schneider Electric Vijeo Designer Versions prior to 6.2 SP12 installed on Schneider Electric HMISCU

Schneider Electric Vijeo Designer Version 6.2 SP12 installed on Schneider Electric HMISCU

Schneider Electric Vijeo Designer Versions 6.2 SP12 (or above) installed on Schneider Electric HMISCU

Schneider Electric Vijeo Designer Versions prior to v6.3 SP1 installed on Schneider Electric HMISTU Series

Schneider Electric Vijeo Designer Version 6.3 SP1 installed on Schneider Electric HMISTU Series

Schneider Electric Vijeo Designer Version 6.3 SP1 (or above) installed on Schneider Electric HMISTU Series

Schneider Electric JACE-8000 optional component of Schneider Electric TAC I/A Series

Niagara Framework Versions prior to v4.10u1 installed on JACE-8000 optional component of Schneider Electric TAC I/A Series

Niagara Framework Version 4.10u1 installed on JACE-8000 optional component of Schneider Electric TAC I/A Series

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.350 installed on Schneider Electric Pro-face SP-5B00

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.350 installed on Schneider Electric Pro-face SP-5B10

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.350 installed on Schneider Electric Pro-face SP-5B90

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.350 installed on Schneider Electric Pro-face ST6000 Series (GP-ProEX model)

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.350 installed on Schneider Electric Pro-face ET6000 Series

Schneider Electric Pro-face GP-Pro EX Version 4.09.350 or later installed on Schneider Electric Pro-face SP-5B00

Schneider Electric Pro-face GP-Pro EX Version 4.09.350 or later installed on Schneider Electric Pro-face SP-5B10

Schneider Electric Pro-face GP-Pro EX Version 4.09.350 or later installed on Schneider Electric Pro-face SP-5B90

Schneider Electric Pro-face GP-Pro EX Version 4.09.350 or later installed on Schneider Electric Pro-face ST6000 Series (GP-ProEX model)

Schneider Electric Pro-face GP-Pro EX Version 4.09.350 or later installed on Schneider Electric Pro-face ET6000 Series

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.450 installed on Schneider Electric Pro-face LT4000M Series

Schneider Electric Pro-face GP-Pro EX Version 4.09.450 or later installed on Schneider Electric Pro-face LT4000M Series

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.400 installed on Schneider Electric Pro-face GP4000 Series

Schneider Electric Pro-face GP-Pro EX Versions prior to 4.09.400 installed on Schneider Electric Pro-face GP4000H Series

Schneider Electric Pro-face GP-Pro EX Version 4.09.400 or later installed on Schneider Electric Pro-face GP4000 Series

Schneider Electric Pro-face GP-Pro EX Version 4.09.400 or later installed on Schneider Electric Pro-face GP4000H Series

Schneider Electric Modicon M580 CPU Safety Version SV4.21 installed on Schneider Electric EcoStruxure™ Control Expert Versions greater than or equal to 16.0 HF001

An issue was discovered in Wind River VxWorks 7. The memory allocator has a possible integer overflow in calculating a memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.

CVE Description

Version 1.0.5 of Easergy C5 includes a fix for these vulnerabilities and
is available through Schneider Electric regional DPACs.

Easergy MiCOM P638 Version 676.701 of the P30 firmware includes a fix for these vulnerabilities and is available on request from Schneider Electric’s Customer Care

All other Easergy MiCOM P30 Models: Version 675 and later of the P30 firmware includes a fix for these vulnerabilities and is available on request from Schneider Electric’s Customer Care Center.

Customers should immediately apply the following mitigations to reduce the risk of exploit: • Use relays only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. • Disable unused network protocol interfaces. • Use firewalls to protect and separate the control system network from other networks. • Activate and apply user management and password features.

Version 4.03 of the EPC2000 includes a fix for these vulnerabilities and is available for download here:https://www.eurotherm.com/?wpdmdl=137741

Version 5.20 of the EPC3000 includes a fix for these vulnerabilities and is available for download here:https://www.eurotherm.com/?wpdmdl=89545 Device will reboot automatically after upgrade.

Version 1.2.1 of Vijeo Designer Basic includes a fix for these vulnerabilities. Please contact your Schneider Electric’s Customer Care Center to obtain the installer. To complete the update, connect to Harmony HMI and download the firmware using Vijeo Designer Basic V1.2.1.

The E+PLC100 product has reached its end of life and is no longer supported.

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to the device.• Configure the Access Control List following the recommendations of the device user manual.• Setup a VPN between the E+PLC100 device and any remote visualization workstations running the E+PLC tools.• Activate and apply user management and password features. Limit the access to both development and control system by physical means, operating system features, etc.

Version 1.4.0.0 of the E+PLC400 firmware is available and includes a fix for these vulnerabilities. Please contact the Eurotherm Support team to obtain the firmware update. Please be sure to include the following when contacting the support team:• End Username, Company, and Email Address• Serial numbers of the devices to be upgraded• Current E+PLC400 firmware versionVersion 7.3 of the Eycon firmware is available and includes a fix for these vulnerabilities. Access to the patch can be obtained through the following link: https://partners.eurotherm.com/member-login

Version 8.2 of the T2550 firmware is available and includes a fix for these vulnerabilities. Access to the patch can be obtained through the following link: https://partners.eurotherm.com/member-login

Version 6.3 of the T2750 firmware is available and includes a fix for these vulnerabilities. Access to the patch can be obtained through the following link:https://partners.eurotherm.com/member-login

Version 6.2 SP11 Multi HotFix 4 of Vijeo Designer includes a fix for these vulnerabilities and can be updated through the Schneider Electric Software Update (SESU) application. On the engineering workstation, update to V6.2 SP11 Multi HotFix 4 (or above) of Vijeo Designer.To complete the update, connect to Harmony HMI and download the project file using Vijeo Designer V6.2 SP11 Multi HotFix 4.

Version 6.2 SP12 of Vijeo Designer includes a fix for these vulnerabilities and can be updated through the Schneider Electric Software Update (SESU) application. On the engineering workstation, update to V6.2 SP12 (or above) of Vijeo Designer. To complete the update, connect to Harmony HMI and download the project file using Vijeo Designer V6.2 SP12.

Version 6.3 SP1 of Vijeo Designer includes a fix for these vulnerabilities and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware On the engineering workstation, update to V6.3 SP1 (or above) of Vijeo Designer. To complete the update, connect to Harmony HMI and download the project file using Vijeo Designer V6.3 SP1.

Versions B5.118, D1.92, D4.38, D5.25I and D6.18 of MiCOM C264 include a fix for these vulnerabilities and are available through Schneider Electric regional DPACs.

Version 5.1.9.34 of Modicon M241/M251 Logic Controllers includes a fix for these vulnerabilities.On the engineering workstation, update to latest version of EcoStruxure Machine Expert: https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-somachine/?parent-subcategory-id=5140&filter=business-1-industrial-automation-and-control To complete the update on Modicon M241/M251 Logic Controllers, update to firmware version V5.1.9.34 or higher available within EcoStruxure Machine Expert. A reboot is needed.

Version 5.1.6.1 of Modicon M262 Logic Controllers includes a fix for these vulnerabilities.On the engineering workstation, update to latest version of EcoStruxure Machine Expert: https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-somachine/?parent-subcategory-id=5140&filter=business-1-industrial-automation-and-controlTo complete the update on Modicon M262 Logic Controllers, update to firmware version V5.1.6.1 or higher available within EcoStruxure Machine Expert. A reboot is needed.

Firmware Version 5.0.4.18 of Modicon M258/LMC058 logic controllers includes a fix for these vulnerabilities and can be updated through Schneider Electric Software Update (SESU) application.

Version 2.11 of BMXNOC0401 includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMXNOC0401/

Version SV3.50 of BMXNOE0100 (H) includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMXNOE0100_SV_03.50/

Version SV6.70 of BMXNOE0110 (H) includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMXNOE0110_SV_06.70/

Version 1.7 IR24 of BMXNOR0200H includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMXNOR0200H/

Version 3.50 of Modicon M340 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/

Version SV4.10 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/

Version SV4.21 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware Important: customer needs to use version of EcoStruxure™ Control Expert V16.0 HF001 minimum to connect with the latest version of M580 CPU Safety. The software is available for download here: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware

Version SV2.21 includes a fix for these vulnerabilities and is available for download here:  BMENOC 0301 - https://www.se.com/ww/en/download/document/BMENOC0301_SV_02.21/

Version SV2.21 includes a fix for these vulnerabilities and is available for download here: BMENOC 0311 -https://www.se.com/ww/en/download/document/BMENOC0311_SV_02.21

Version SV1.09 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMENOC0321_SV_01.09

Version SV1.5 of HART X80 Module includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMEAHO0412_Firmware_upgrade/

Version 1.8 of MC80 Controller (BMKC80) includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-range/62396-modicon-mc80/#software-and-firmware

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to the device.• Configure the Access Control List following the recommendations in the device user manual.• Setup a VPN between the Modicon PLC device and the remote engineering workstations.• Activate and apply user management and password features.• Limit the access to both development and control system by physical means, operating system features, etc.

Version SV2.6 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/Momentum_FW_update/

Quantum and Premium offers have reached their end of life and are no longer supported.

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to the device.• Setup a VPN between the Modicon PLC device and the remote engineering workstations.• Activate and apply user management and password features.• Limit the access to both development and control system by physical means, operating system features, etc.Customers should also consider upgrading to the latest product offering Modicon M580 ePAC.

Version 1.60 of BMXNOM0200 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMXNOM0200/

Version 1.04 of BMENOS0300 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMENOS0300/

Version 10.02 of nanodac includes a fix for this vulnerability and is available for download here: https://www.eurotherm.com/?wpdmdl=28419 Device will reboot automatically after upgrade.

Firmware Version 1.66.5.1 of PacDrive Eco/Pro/Pro2 Logic Controllers includes a fix for these vulnerabilities and can be updated through the Schneider Electric Software Update (SESU) application.

PacDrive M Logic Controller has reached its end of life and is no longer supported.

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside,• Use firewalls to protect and separate the control system network from other networks,• Use VPN (Virtual Private Networks) tunnels if remote access is required,• Activate and apply user management and password features,• Limit the access to both development and control system by physical means, operating system features, etc.Customers should also consider upgrading to the latest product offering PacDrive Eco/Pro/Pro2 to resolve this issue.

Version 3.1 of PowerLogic ION7400 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/ION7400_meter_FW_v003.001.000/

Version 3.1 of PowerLogic PM8000 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/PM8000_meter_FW_v003.001.000/

Version 3.1 of PowerLogic ION9000 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/ION9000_meter_FW_v003.001.000/

If the update cannot be applied immediately, please follow the guidelines in Schneider Electric Recommended Cybersecurity Best Practices document to help mitigate the risk.

Version 4.09.350 of Pro-face GP-Pro EX includes a fix for these vulnerabilities and is available for download here: https://www.proface.com/en/download/trial/gpproex/v40 or update online via GP-Pro EX (refer to Help menu and select “Confirm Update of GP-Pro EX”).To complete the update, connect to Pro-face HMI and download the project file using GP-Pro EX V4.09.350 or later.

Version 4.09.450 of Pro-face GP-Pro EX includes a fix for these vulnerabilities and is available for download here: https://www.proface.com/en/download/trial/gpproex/v40 or update online via GP-Pro EX (refer to Help menu and select “Confirm Update of GP-Pro EX”). To complete the update, connect to Pro-face HMI and download the project file using GP-Pro EX V4.09.400 or later.

Version 4.09.400 of Pro-face GP-Pro EX includes a fix for these vulnerabilities and is available for download here: https://www.proface.com/en/download/trial/gpproex/v40 or update online via GP-Pro EX (refer to Help menu and select “Confirm Update of GP-Pro EX”). To complete the update, connect to Pro-face HMI and download the project file using GP-Pro EX V4.09.400 or later.

Customers should immediately apply the mitigations found in the Cybersecurity Reference Manual linked below to reduce the risk of exploit: https://www.se.com/ww/en/download/document/EIO0000001999/

Version SY-1101207, Version N of SCD6000 firmware includes a fix for this vulnerability. Contact your local Customer Support to receive this firmware version. Reboot is required after installation.

Version C3414-500-S02K5_P5 of SAGE RTU CPU 3414 includes a fix for this vulnerability and is available for download here: https://www.sage-rtu.com/downloads.html Reboot of SAGE RTU is required after firmware upgrade.This fix applies a Wind River VxWorks (real-time operating system) patch to bring code libraries current to 6.9.4.12 RCPL3 revision. This corrects issues with overflow causing malloc/calloc to return valid pointer when it should return fail indication NULL pointer.

Version 2.43 of the Versadac scalable data recorder is available and includes a fix for these vulnerabilities.Access to the patch can be obtained through the following link: https://partners.eurotherm.com/member-login

Version SV02.80 of BMECRA31210, BMXCRA3120, BMXCRA31210 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product&sourceId=BMXCRA31210

Version V02.80 of 140CRA31200 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product/140CRA31200/quantum-rio-drop-e-ip-1ch

Version V02.80 of 140CRA31908 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product/140CRA31908/m580-quantum-s908-rio-drop-adapter

Version SV2.6 of BMENOP0300 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product&sourceId=BMENOP0300

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to the device.• Configure the Access Control List following the recommendations of the device user manual.• Setup a VPN between the Modicon. Communication modules and the remote engineering workstations.• Activate and apply user management and password features.Limit the access to both development and control system by physical means, operating system features, etc.

Customers should immediately apply the following mitigations to reduce the risk of exploit: • Use relays only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.• Disable unused network protocol interfaces.• Use firewalls to protect and separate the control system network from other networks.• Activate and apply user management and password features.• Limit the access to the system by physical means.

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to the device.• Configure the Access Control List following the recommendations of the device user manual.• Setup a VPN between the EPack device and any remote visualization workstations running iTools.• Activate and apply user management and password features. Limit the access to both development and control system by physical means, operating system features, etc.

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.• Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.• Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.When remote access is required, use secure methods, such as the Vijeo Connect.

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside,• Use firewalls to protect and separate the control system network from other networks,• Use VPN (Virtual Private Networks) tunnels if remote access is required,• Activate and apply user management and password features,• Limit the access to both development and control system by physical means, operating system features, etc.Customers should also consider upgrading to the latest product offering Modicon M262 to resolve this issue.

Customers should immediately apply the followingmitigations to reduce the risk of exploit:• Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.• Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment,and networks.• Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.• When remote access is required, use secure methods, such as the Pro-face Connect.Customers should also consider upgrading to the latest product offering to resolve this issue. Please contact your sales support about alternative products

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to the device.• Configure the Access Control List following the recommendations of the device user manual.• Setup a VPN between the 6000-series device and any remote visualization workstations running Bridge.• Activate and apply user management and password features. Limit the access to both development and control system by physical means, operating system features, etc.

CVE-2020-35198

In Wind River VxWorks, memory allocator has a possible overflow in calculating the memory block's size to be allocated by calloc(). As a result, the actual memory allocated is smaller than the buffer size specified by the arguments, leading to memory corruption.

CVE Description

Version 1.0.5 of Easergy C5 includes a fix for these vulnerabilities and
is available through Schneider Electric regional DPACs.

Easergy MiCOM P638 Version 676.701 of the P30 firmware includes a fix for these vulnerabilities and is available on request from Schneider Electric’s Customer Care

All other Easergy MiCOM P30 Models: Version 675 and later of the P30 firmware includes a fix for these vulnerabilities and is available on request from Schneider Electric’s Customer Care Center.

Version 01.401.101 of Easergy P5 firmware includes a fix for this vulnerability and is available on request from Schneider Electric's Customer Care Center.

Version 4.03 of the EPC2000 includes a fix for these vulnerabilities and is available for download here:https://www.eurotherm.com/?wpdmdl=137741

Version 5.20 of the EPC3000 includes a fix for these vulnerabilities and is available for download here:https://www.eurotherm.com/?wpdmdl=89545 Device will reboot automatically after upgrade.

The E+PLC100 product has reached its end of life and is no longer supported.

Version 8.2 of the T2550 firmware is available and includes a fix for these vulnerabilities. Access to the patch can be obtained through the following link: https://partners.eurotherm.com/member-login

Version 6.3 of the T2750 firmware is available and includes a fix for these vulnerabilities. Access to the patch can be obtained through the following link:https://partners.eurotherm.com/member-login

Versions B5.118, D1.92, D4.38, D5.25I and D6.18 of MiCOM C264 include a fix for these vulnerabilities and are available through Schneider Electric regional DPACs.

Firmware Version 5.0.4.18 of Modicon M258/LMC058 logic controllers includes a fix for these vulnerabilities and can be updated through Schneider Electric Software Update (SESU) application.

Version 2.11 of BMXNOC0401 includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMXNOC0401/

Version SV3.50 of BMXNOE0100 (H) includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMXNOE0100_SV_03.50/

Version SV6.70 of BMXNOE0110 (H) includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMXNOE0110_SV_06.70/

Version 1.7 IR24 of BMXNOR0200H includes a fix for thesevulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMXNOR0200H/

Version 3.50 of Modicon M340 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/

Version SV4.10 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/

Version SV2.21 includes a fix for these vulnerabilities and is available for download here:  BMENOC 0301 - https://www.se.com/ww/en/download/document/BMENOC0301_SV_02.21/

Version SV2.21 includes a fix for these vulnerabilities and is available for download here: BMENOC 0311 -https://www.se.com/ww/en/download/document/BMENOC0311_SV_02.21

Version SV1.09 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMENOC0321_SV_01.09

Version SV1.5 of HART X80 Module includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/download/document/BMEAHO0412_Firmware_upgrade/

Version 1.8 of MC80 Controller (BMKC80) includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-range/62396-modicon-mc80/#software-and-firmware

Version SV2.6 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/Momentum_FW_update/

Quantum and Premium offers have reached their end of life and are no longer supported.

Version 1.60 of BMXNOM0200 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMXNOM0200/

Version 1.04 of BMENOS0300 includes a fix for these vulnerabilities and is available for download here:https://www.se.com/ww/en/product/BMENOS0300/

Version 10.02 of nanodac includes a fix for this vulnerability and is available for download here: https://www.eurotherm.com/?wpdmdl=28419 Device will reboot automatically after upgrade.

Firmware Version 1.66.5.1 of PacDrive Eco/Pro/Pro2 Logic Controllers includes a fix for these vulnerabilities and can be updated through the Schneider Electric Software Update (SESU) application.

PacDrive M Logic Controller has reached its end of life and is no longer supported.

Version 3.1 of PowerLogic ION7400 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/ION7400_meter_FW_v003.001.000/

Version 3.1 of PowerLogic PM8000 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/PM8000_meter_FW_v003.001.000/

Version 3.1 of PowerLogic ION9000 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/ION9000_meter_FW_v003.001.000/

If the update cannot be applied immediately, please follow the guidelines in Schneider Electric Recommended Cybersecurity Best Practices document to help mitigate the risk.

Customers should immediately apply the mitigations found in the Cybersecurity Reference Manual linked below to reduce the risk of exploit: https://www.se.com/ww/en/download/document/EIO0000001999/

Version SY-1101207, Version N of SCD6000 firmware includes a fix for this vulnerability. Contact your local Customer Support to receive this firmware version. Reboot is required after installation.

Version 2.43 of the Versadac scalable data recorder is available and includes a fix for these vulnerabilities.Access to the patch can be obtained through the following link: https://partners.eurotherm.com/member-login

Version SV02.80 of BMECRA31210, BMXCRA3120, BMXCRA31210 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product&sourceId=BMXCRA31210

Version V02.80 of 140CRA31200 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product/140CRA31200/quantum-rio-drop-e-ip-1ch

Version V02.80 of 140CRA31908 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product/140CRA31908/m580-quantum-s908-rio-drop-adapter

Version SV2.6 of BMENOP0300 includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product&sourceId=BMENOP0300

CVE-2020-28895

An integer overflow vulnerability in the calloc() function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform (SDP) version(s) 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to potentially perform a denial of service or execute arbitrary code.

CVE Description

Updates have been released to address the identified vulnerability Customers are urged to upgrade to Niagara 4.10u1.
These updates are available on the Schneider Electric Exchange https://ecoxpert.se.com/ or by contacting your sales support channel or by contacting the Schneider Electric support team at productsupport.NAM-BMS@schneider-electric.com It is important that all TAC I/A Series Niagara customers for all supported platforms update their systems with these releases to mitigate risk. If you have any questions, please contact your Schneider Electric support team at productsupport.NAM-BMS@schneider-electric.com. As always, we highly recommend that TAC I/A Series Niagara customers running on an unsupported platform (such as Niagara G3/AX) take action to update their systems to a supported platform, ideally the 4.10u1 release of Niagara Framework. In addition to updating your system, Schneider Electric recommends that customers with affected products take the following steps to protect themselves:
• Review and validate the list of users who are authorized and who can authenticate to Niagara.
• Allow only trained and trusted persons to have physical access to the system, including devices that have connection to the system though the Ethernet port.
• Consider using a VPN or other means to ensure secure remote connections into the network where the system is located, If remote connections are enabled.
• Sign all modules and program objects provided by third-party teams.
Review the Niagara Hardening Guide https://community.exchange.se.com/t5/Building-Automation-Knowledge/I-A-Series-Niagara-4-Hardening-Guide-Tips-to-Secure-an-I-A/ta-p/159287 for techniques on securing your installation.

CVE-2021-22156


Eurotherm GUIcon

Summary: Original Release

Summary: Eurotherm GUIcon - SEVD-2021-313-07 PDF Version

Summary: Eurotherm GUIcon - SEVD-2021-313-07 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its GUIcon software.
The GUIcon software was a configuration tool for the discontinued penGUIn HMI range.
Failure to apply the mitigations provided below may risk code belonging to the attacker being executed on the host PC, leading to Denial of Service, sensitive information disclosure, or unintended user actions.

Overview

Eurotherm by Schneider Electric

GUIcon

Eurotherm by Schneider Electric GUIcon (Build 683.003) 2.0 and prior

CVE-2021-22807

A CWE-787: Out-of-bounds Write vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon tool.

CVE Description

The GUIcon software tool was discontinued on 24 June 2020 and is no longer supported. Customers should immediately apply the following mitigation to reduce the risk of exploit:
The only known method for an attacker to exploit the vulnerabilities is to create a malicious GUIcon *.gd1 configuration file and then trick a user into opening it with the GUIcon software, resulting in possible remote code execution.
Therefore, the specific mitigation for these vulnerabilities is to ensure that any GUIcon *.gd1 file being loaded into the tool is from a trusted source.

CVE-2021-22808

A CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution when a malicious *.gd1 configuration file is loaded into the GUIcon tool.

CVE Description

CVE-2021-22809

A CWE-125:Out-of-Bounds Read vulnerability exists that could cause unintended data disclosure when a malicious *.gd1 configuration file is loaded into the GUIcon tool.

CVE Description


Summary: Original Release

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2021-348-01 PDF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2021-348-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Data Collector module for the IGSS (Interactive Graphical SCADA System) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. IGSS communicates with all major industry standard PLC drivers.
Failure to apply the remediations provided below may risk loss of data or denial of service, which in worst case could result in problems controlling the SCADA System from the machine running IGSS in production.

https://igss.schneider-electric.com/

Overview

Schneider Electric

IGSS Data Collector (dc.exe)

Schneider Electric IGSS Data Collector (dc.exe) V15.0.0.21320 and prior

Schneider Electric IGSS Data Collector (dc.exe) v15.0.0.21321

CVE-2021-22823

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network messages.

CVE Description

Version 15.0.0.21321 of the IGSS DC module: dc.exe includes fixes for these vulnerabilities and is available for download through IGSS Master > Update IGSS Software or here:
https://igss.schneider-electric.com/igss/igssupdates/v150/IGSSUPDATE.ZIP
Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Only accept incoming connections from machines, which name have been added as a Station in the IGSS System Configuration module by setting the registry key called “MatchWinName” to 1 under: “HKEY_CURRENT_USER\SOFTWARE\Schneider Electric\IGSS32\V15.00.00\DC_HKLM\”.
• Follow the general security recommendation below and verify that devices are isolated on a private network and that firewalls are configured with strict boundaries for devices that require remote access.

CVE-2021-22824

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length check on user-supplied data from a constructed message received on the network.

CVE Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')


Summary: Original Release

Summary: EVlink City / Parking / Smart Wallbox Charging Stations - SEVD-2021-348-02 PDF Version

Summary: EVlink City / Parking / Smart Wallbox Charging Stations - SEVD-2021-348-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EVlink City, Parking, and Smart Wallbox products.
The EVlink products are electric vehicle (EV) charging stations for private properties, semi-public car parks and on-street charging.
These vulnerabilities can be exploited by obtaining physical access either to the charging station’s internal communication port, which requires disassembling the charging station enclosure, or, in the case of a connected station, to the network of the charging station’s supervision system. The risk is further elevated when the connected stations are accessible over the internet and have insufficient network security measures.
Customers should immediately apply the available remediations. Failure to do so may risk potential unauthorized access to the charging station’s web server, which could lead to tampering and compromise of the charging station’s settings and accounts. Such tampering could lead to things like denial of service attacks, which could result in unauthorized use of the charging station, service interruptions, failure to send charging data records to the supervision system and the modification and disclosure of the charging station’s configuration.
In addition to applying the available remediations to limit the risk of a connected charging station being compromised, Schneider Electric recommends that customers follow and apply network security best practices and ensure that the charging stations are not accessible from the internet, as outlined in the General Security Recommendations section.
For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center.
https://www.se.com/ww/en/product-category/1800-electric-vehicle-%28ev%29-charging/

Overview

EVlink Parking products with references EVF1 / EVW1 and EVlink City products with references EVC1S22P3 / EVC1S7P3 or older have reached their end of life and are no longer supported. Customers should consider replacing the charging station by the latest EVlink Parking and EVlink City product offering to resolve these issues. Always follow the recommendations provided in the General Security Recommendations section below in order to harden the security of the network where the charging station is connected (in case of a supervised station) and ensure that the station is not reachable from outside this network.

Recommendations for End of Life Offers

Schneider Electric

EVlink City

Schneider Electric EVlink City versions prior to R8 V3.4.0.2

EVlink Parking

Schneider Electric EVlink Parking versions prior to R8 V3.4.0.2

EVlink Wallbox

Schneider Electric EVlink Wallbox versions prior to R8 V3.4.0.2

EVlink City

Schneider Electric EVlink City R8 (3.4.0.2)

EVlink Parking

Schneider Electric EVlink Parking R8 (3.4.0.2)

EVlink Smart Wallbox

Schneider Electric EVlink Smart Wallbox R8 (3.4.0.2)

CVE-2021-22724

A CVE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could allow an attacker to impersonate the user or carry out actions on their behalf when crafted malicious parameters are submitted in POST requests sent to the charging station web server.

CVE Description

Version R8 V3.4.0.2 of the EVlink City, Parking and Smart Wallbox products include a fix for these vulnerabilities and is available for download below:
To ensure the fix is applied, the new firmware version can be verified by connecting to the station web server and consulting the firmware update tab in the maintenance section. The version for both the electronic board and the commissioning tool is 3400-2 or newer.

CVE-2021-22725

A CWE-352 Cross-Site Request Forgery (CSRF) vulnerability exists that could cause allow an attacker to perform unintended actions when crafted malicious parameters are submitted in GET requests sent to the charging station web server.

CVE Description

CVE-2021-22818

A CWE-307 Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to gain unauthorized access to the charging station web interface by performing brute force attacks.

CVE Description

CVE-2021-22819

A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes.

CVE Description

CVE-2021-22820

A CWE-614 Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain an unauthorized access over a hijacked session to the charger station web server even after the legitimate user account holder has changed his password.

CVE Description

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

CVE-2021-22821

A CWE-918 Server-Side Request Forgery (SSRF) vulnerability exists that could cause the station web server to forward requests to unintended network targets when crafted malicious parameters are submitted to the charging station web server.

CVE Description

CVE-2021-22822

A CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists that could allow an attacker to impersonate the user who manages the charging station or carry out actions on their behalf when crafted malicious parameters are submitted to the charging station web server.

CVE Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')


APC by Schneider Electric Rack PDU

Summary: Original Release

Summary: CVSS score updated to 6.5.

Summary: APC by Schneider Electric Rack PDU - SEVD-2021-348-04 PDF Version

Summary: APC by Schneider Electric Rack PDU - SEVD-2021-348-04 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Rack Power Distribution Unit (PDU) products.
The Rack PDU products (AP7xxxx, AP8xxxx, and APDU9xxx series) are devices that provide real-time remote monitoring at the outlet level to provide:
• advanced data center energy management
• advanced load management
• on/off outlet level power cycling
• sequencing control
Failure to apply the mitigations provided below may risk a cross-site scripting attack, which could result in execution of malicious web code, or unintended device operation.
CVSS score updated to 6.5.

Overview

Schneider Electric

Schneider Electric AP7xxxx-NMC2 V6.9.6 or earlier

Schneider Electric AP8xxx-NMC2 V6.9.6 or earlier

Schneider Electric AP7xxx-NMC3 V1.1.0.3 or earlier

Schneider Electric AP8xxx-NMC3 V1.1.0.3 or earlier

Schneider Electric APDU9xxx-NMC3 V1.0.0.28 or earlier

AP7xxxx with NMC2

Schneider Electric AP7xxxx with NMC2 7.0.6

AP8xxx with NMC2

Schneider Electric AP8xxx with NMC2 7.0.6

AP7xxx with NMC3

Schneider Electric AP7xxx with NMC3 1.2.0.2

AP8xxx with NMC3

Schneider Electric AP8xxx with NMC3 1.2.0.2

APDU9xxx with NMC3

Schneider Electric APDU9 with NMC3 1.2.0.2

CVE-2021-22825

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could allow an attacker to access the system with elevated privileges when a privileged account clicks on a malicious URL that compromises the security token.

CVE Description

V7.0.6 of the Rack PDU firmware includes a fix for this vulnerability and is available for download here
• Rack PDU v7.0.6 firmware here
• Device must be rebooted as part of the update process
• Verify the firmware version is correct once the update is complete

V1.2.0.2 of the Rack PDU firmware includes a fix for this vulnerability and is available for download here
• Rack PDU v1.2.0.2 firmware here
• Release notes here
• Device must be rebooted as part of the update process
• Verify the firmware version is correct once the update is complete

If customers choose not to apply the remediations provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Discontinue the use of outlet links until the firmware upgrade is applied.


Summary: Original Release

Summary: Ethernet and Web server on Modicon M340 controller and Communication Modules - SEVD-2022-011-01 PDF Version

Summary: Ethernet and Web server on Modicon M340 controller and Communication Modules - SEVD-2022-011-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Modicon M340 controller and Communication Modules.
The Modicon Ethernet Programmable Automation products are controllers for industrial process and infrastructure.
The Modicon M340 offers compactness, flexibility, scalability, and robustness for the process industry and a wide range of demanding automation applications. The Eagle40 device and the accompanying security guidance are intended to be the full solution for these vulnerabilities.
Failure to apply the mitigations provided below may risk disclosure of sensitive information, unauthorized web server actions and denial of service.

Overview

Schneider Electric

Modicon M340 CPUs

all

Schneider Electric Modicon M340 CPUs all

all

Schneider Electric Modicon Quantum CPUs with integrated Ethernet (Copro) all

Schneider Electric Modicon Premium CPUs with integrated Ethernet (Copro) all

Modicon M340 ethernet modules

Schneider Electric Modicon M340 ethernet modules all

all

Schneider Electric Modicon Quantum and Premium factory cast communication modules all

CVE-2022-22724

A CWE-400: Uncontrolled Resource Consumption vulnerability exists that could cause a denial
of service on ports 80 (HTTP) and 502 (Modbus), when sending a large number of TCP RST or
FIN packets to any open TCP port of the PLC

CVE Description

Customers should immediately apply the following mitigations to reduce
the risk of exploit. For further details please check the Cyber Security
Reference Manual available here: Modicon Controllers Platform - Cyber
Security, Reference Manual User guide | Schneider Electric
• Setup a VPN between the Modicon PLC modules and the
engineering workstation containing EcoStruxure Control Expert
or EcoStruxure Process Expert.
For the M340 offer, the recommended configuration is
described in the section “How to protect M340 architectures
with EAGLE40 using a VPN” of the EcoStruxure Control
Expert online help.
• Configure the Access Control List following the
recommendations of the user manual “Modicon M340 for
Ethernet Communications Modules and Processors User
Manual” in chapter “Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K010
00/
• Setup network segmentation and configure a firewall to block all
unauthorized access to TCP ports 502 and 80
• Disable the HTTP service and other communications services
(FTP, SMTP, etc.) when not needed or restrict access to
authorized users
Please note these mitigations may not be sufficient on older product
firmware versions. Products must be updated to the most current
version available:
• M340 CPU v3.40 :
https://www.se.com/ww/en/download/document/BMXP34xxxxx_
SV_xx.xx/
• Quantum 140CPU65xxx Copro v6.1 :
https://www.se.com/fr/fr/download/document/140CPU65260+Qu
antum+Copro+Exec+and+Release+Notes/
• Premium TSXP57xxx Copro v6.1: TSXP574634M Ethernet
Copro Firmware | Schneider Electric (se.com)

CVE-2020-7534

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists on the web server
used, that could cause a leak of sensitive data or unauthorized actions on the web server during
the time the user is logged in.

CVE Description

Customers should immediately apply the following mitigations to reduce
the risk of exploit. For further details please check the Cyber Security
Reference Manual available here: Modicon Controllers Platform - Cyber
Security, Reference Manual User guide | Schneider Electric
• Setup a VPN between the Modicon PLC modules and the
engineering workstation containing EcoStruxure Control Expert or
EcoStruxure Process Expert.
For the M340 offer, the recommended configuration is described in
the section “How to protect M340 architectures with EAGLE40
using a VPN” of the EcoStruxure Control Expert online help.
• Configure the Access Control List following the recommendations
of the user manual “Modicon M340 for Ethernet Communications
Modules and Processors User Manual” in chapter “Messaging
Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/
• Setup network segmentation and configure a firewall to block all
unauthorized access to TCP ports 502 and 80
• Disable the HTTP service and other communications services
(FTP, SMTP, etc.) when not needed or restrict access to
authorized users
Please note these mitigations may not be sufficient on older product
firmware versions. Products must be updated to the most current
version available:
• BMXNOE0110 v6.60
https://www.se.com/ww/en/download/document/BMXNOE0110
%20Exec%20and%20Release%20Notes/?searchSource=guide
d
• BMXNOE0100 v3.40
https://www.se.com/ww/en/download/document/BMXNOE0100%20Exec%20and%20Release%20Notes/?searchSource=guided
• BMXNOC0401 v2.10
https://www.se.com/ww/en/download/document/BMXNOC0401
%20Exec%20and%20Release%20Notes/?searchSource=guide
d
• BMXNOR0200H v1.70 IR23:
https://www.se.com/ww/en/download/document/BMXNOR0200
H_FW/?searchSource=guided

Customers should immediately apply the following mitigations to reduce
the risk of exploit. For further details please check the Cyber Security
Reference Manual available here: Modicon Controllers Platform - Cyber
Security, Reference Manual User guide | Schneider Electric
• Setup network segmentation and configure the firewall to block
all unauthorized access to TCP ports 502 and 80
• Disable the HTTP service and other communications services
(FTP, SMTP, etc) when not needed or restrict access to
authorized users
Please note these mitigations may not be sufficient on older product
firmware versions. Products must be updated to the most current
version available:
• 140NOE771x1 v7.3:
https://www.se.com/ww/en/download/document/140NOE77111
+Exec+and+Release+Notes+For+Unity+and+Non+Unity+Users/
• 140NOC78*00 v1.74 :
https://www.se.com/ww/en/download/document/140NOC78000
+Exec+and+Release+Notes/
• TSXETY5103 v6.4:
https://www.se.com/ww/en/download/document/TSXETY5103
Exec/?searchSource=guided
• TSXETY4100 v6.2:
https://www.se.com/ww/en/download/document/TSXETY4103
Exec and Release Notes/?searchSource=guided


Easergy T300

Summary: Original Release

Summary: Easergy T300 - SEVD-2022-011-02 PDF Version

Summary: Easergy T300 - SEVD-2022-011-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Easergy T300 RTU (Remote Terminal Unit).
The Easergy T300 is a modular platform for medium voltage and low voltage public distribution network management.
Failure to apply the mitigations provided below may allow for arbitrary code execution, which could result in denial of service.

Overview

CVE-2020-8597

A point-to-point (pppd) communication library deployed with the T300 is vulnerable to CVE2020-8597, a CWE-120: Buffer Copy without Checking Size of Input vulnerability, which may
allow for arbitrary code execution and lead to a denial of service when an attacker gains access
to a connected cellular network. The CVSS score, provided above, is evaluated as Medium in
the product context.

CVE Description

Note: Only products connected to a 3G/4G network using the following T300 modems are vulnerable:
- Easergy HU250 3G modem box - Five Bands UMTS/HSPA+
- Easergy HU250 4G modem box with GPS clock
synchronization

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Easergy T300 firmware V2.8 includes a fix for this vulnerability and is available from the
Schneider Electric Customer Care Center.
Note: The 3G/4G hardware is optional and the feature is disabled by default.
In case this feature is used as a communication channel, it is recommended to disable it until
the firmware is upgraded.


Easergy P5

Summary: Original Release

Summary: Updated remediation instructions for clarity

Summary: Easergy P5 - SEVD-2022-011-03 PDF Version

Summary: Easergy P5 - SEVD-2022-011-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Easergy P5 product line.
The Easergy P5 is a medium voltage protection relay.
Failure to apply the mitigations or remediations provided below may risk disclosure of the device
credentials, denial of service, device reboot, or at attacker gaining full control of the relay. This
could result in loss of protection to your electrical network.

Overview

Schneider Electric

Easergy P5

< 01.401.101

Schneider Electric Easergy P5 < 01.401.101

Schneider Electric Easergy P5 01.401.101

Schneider Electric Easergy P5 01.303.202

CVE-2022-22722

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information
disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take
active control of the local operational network connected to the product they could potentially
observe and manipulate traffic associated with product configuration.

CVE Description

Timothée Chauvin
Paul Noalhyt
Yuanshe Wu

For CVE-2022-22723 only, if customers choose not to apply the remediation provided above,
they should immediately apply the following mitigation to reduce the risk of exploit:
Disable the GOOSE service of the product to reduce the risk of exposure. If GOOSE is needed
for the application use it only in a secure local area network.
Customers should use appropriate patching methodologies when applying these patches to
their systems. We strongly recommend the use of back-ups and evaluating the impact of these
patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

CVE-2022-22723

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a
buffer overflow causing program crashes and arbitrary code execution when specially crafted
packets are sent to the device over the network. Protection functions and tripping function via
GOOSE can be impacted.

CVE Description

Versions 01.401.101 and 01.303.202 of the Easergy P5 Firmware include a fix for these
vulnerabilities. The version to be used depends on the existing firmware in the Easergy P5. The
firmware packages are available on request from Schneider Electric’s Customer Care Center
which will provide the guidelines on the version to be used.


Easergy P3

Summary: Original Release

Summary: Easergy P3 - SEVD-2022-011-04 PDF Version

Summary: Easergy P3 - SEVD-2022-011-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Easergy P3 products.
The Easergy P3 is a medium voltage protection relay.
Failure to apply the mitigations or remediations provided below could lead to communications
loss, device reboot, or at attacker gaining full control of the relay. This could result in loss of
protection to your electrical network.

Overview

: CVE-2022-22725

CVE Description

Timothée Chauvin, Paul Noalhyt, Yuanshe Wu

Version 30.205 of the Easergy P3 firmware includes a fix for this vulnerability and is available on
request from Schneider Electric’s Customer Care Center.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigation to reduce the risk of exploit:
Disable the GOOSE service of the product to reduce the risk of exposure. If GOOSE is
needed for the application use it only in a secure local area network


Summary: Original Release

Summary: ConneXium Tofino Firewall and Loadable Security Modules - SEVD-2022-011-05 PDF Version

Summary: ConneXium Tofino Firewall and Loadable Security Modules - SEVD-2022-011-05 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its ConneXium Tofino Firewall products,
and associated Loadable Security Modules (LSM)
Connexium Tofino Firewall and LSM products are part of the ConneXium Tofino Industrial
Security Solution providing package for securing industrial control systems, particularly at the
Local Area Network (LAN) level. These firewalls are installed in front of individual and/or
clusters of Human Machine Interfaces (HMI), Distributed Control Systems (DCS),
Programmable Logic Controllers (PLC), or Remote Terminal Units (RTU) control devices that
require protection.
Failure to apply the remediations provided below may risk Denial of Service, local code execution, and firmware injection, which could result in service interruption, unexpected device behavior, or device configuration changes to allow malicious network traffic.

Overview

Schneider Electric

ConneXium Tofino Firewall

Schneider Electric ConneXium Tofino Firewall <v03.23

Schneider Electric ConneXium Tofino Firewall v03.23

ConneXium Tofino OPCLSM

<Firewall host version v03.23

Schneider Electric ConneXium Tofino OPCLSM <Firewall host version v03.23

ConneXium Tofino OPCLSM

Firewall host version v03.23

Schneider Electric ConneXium Tofino OPCLSM Firewall host version v03.23

ConneXium Tofino Firewall

<all

Schneider Electric ConneXium Tofino Firewall <all

CVE-2021-30061

An attacker can execute code on the Tofino device by attaching a USB stick with a specially
crafted file to the device.

CVE Description

Version v03.23 includes a fix for vulnerabilities CVE-2021-
30061, CVE-2021-30064, CVE-2021-30065, CVE-2021-
30066.
The firmware can be accessed through the Tofino Security user account created at first time registration.
Instruction to apply the upgrade can be found in chapter
“Upgrading Your Tofino SA” in the device user manual.

ConneXium Tofino Firewall TCSEFA23F3F20 and
TCSEFA23F3F21 products have reached their end of life
and are no longer supported. These have been replaced
with a newer reference TCSEFA23F3F22. Customers using
obsolete Tofino Firewall references are strongly suggested
to migrate to the TCSEFA23F3F22.
Customers should immediately apply the following
mitigations to reduce the risk of exploit:
• Restrict physical and logical access to the Tofino
devices to trusted personnel.
• Connect devices with the Tofino Configurator before
leaving them physically unsupervised.
• Setup network segmentation and configure the
firewall rules to block all unauthorized device.

CVE-2021-30064

An attacker can access an uncommissioned Tofino device using hardcoded default credentials
via SSH.

CVE Description

CVE-2021-30065

An attacker can bypass the Modbus enforcer using crafted Modbus packets

CVE Description

CVE-2021-30066

An attacker can bypass firmware signature verification on a USB stick and load arbitrary
firmware images on the device.

CVE Description

CVE-2021-30062

An attacker can bypass the OPC enforcer using crafted OPC packets.

CVE Description

Version v03.23 of TCSEFEA23F3F22 includes a fix for
vulnerabilities CVE-2021-30062 and CVE-2021-30063.
Customer using this optional LSM can access to the
firmware containing upgraded module through the Tofino
Security user account created at first time registration.
Note: There is no separate process to upgrade LSM only.
Instruction to apply the upgrade can be found in chapter
“Upgrading Your Tofino SA” in the device user manual.

CVE-2021-30063

An attacker can cause a denial of service in the OPC enforcer using crafted OPC packets.

CVE Description