Summary: Original Release

Summary: Remediation available for M241/M251. Added Easy Harmony ET6 (HMIET Series) and Easy Harmony GXU (HMIGXU Series) to the list of affected products.

Summary: Remediation available for Eurotherm E+PLC400 and Eurotherm E+PLC tools. End of commercialization for Eurotherm E+PLC100.

Summary: Remediation available for EcoStruxureTM Machine Expert.

Summary: A remediation is available for Harmony/Magelis HMI products

Summary: Remediation available for Easy Harmony ET6 (HMIET Series) and Easy Harmony GXU (HMIGXU Series)

Summary: CODESYS V3 Runtime, Development System, and Gateway Vulnerabilities - SEVD-2022-011-06 CSAF Version

Summary: CODESYS V3 Runtime, Development System, and Gateway Vulnerabilities - SEVD-2022-011-06 PDF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Note regarding vulnerability details

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities disclosed by Codesys on CODESYS V3 Runtime, Development System and Gateway. Many vendors, including Schneider Electric,
embed CODESYS in their offers. If successfully exploited, these vulnerabilities could result in denial of service or, in some cases, remote code execution.
Customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from possible exploitation of these vulnerabilities.
Where appropriate, this includes locating their industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following
the mitigations and general security recommendations below.
For additional information and support, please contact your Schneider Electric sales or service
representative or Schneider Electric’s Customer Care Center.
March 2023 Update: A remediation is available for HMISTU Series / HMIGTO Series / HMIGTU Series / HMIGTUX Series / HMIGK Series

Overview

Schneider Electric

EcoStruxure Machine Expert

Schneider Electric EcoStruxure Machine Expert version prior to 2.0.3

Schneider Electric EcoStruxure Machine Expert 2.0.3

Eurotherm E+PLC100

Schneider Electric Eurotherm E+PLC100 All Versions

Eurotherm E+PLC400

Schneider Electric Eurotherm E+PLC400 version prior to 1.3.0.1

Schneider Electric Eurotherm E+PLC400 1.4.0.0

Eurotherm E+PLC tools

Schneider Electric Eurotherm E+PLC tools version 1.3.0.1 and prior

Schneider Electric Eurotherm E+PLC tools 1.4.0.0

Schneider Electric M241/M251 versions prior to 5.1.9.34

>=1.2.1 Hotfix 3

Schneider Electric Easy Harmony ET6 (HMIET Series) - Vijeo Designer Basic version 1.2.1 Hotfix 3 and later

Schneider Electric Easy Harmony GXU (HMIGXU Series) - Vijeo Designer Basic version 1.2.1 Hotfix 3 and later

V1.2.1 HotFix 4

Schneider Electric Easy Harmony ET6 (HMIET Series) - Vijeo Designer Basic V1.2.1 HotFix 4

Schneider Electric Easy Harmony GXU (HMIGXU Series) - Vijeo Designer Basic V1.2.1 HotFix 4

Harmony / Magelis - HMISTU Series, HMIGTO Series, HMIGTU Series, HMIGTUX Series, HMIGK Series

<=6.2 SP11 Hotfix 3

Schneider Electric Harmony/ Magelis HMISTU Series  - Vijeo Designer Basic version 6.2 SP11 Hotfix 3 and prior

6.2 SP11 Hotfix 4

Schneider Electric Harmony/ Magelis HMISTU Series  - Vijeo Designer Basic 6.2 SP11 Hotfix 4

Schneider Electric Harmony/ Magelis HMISCU Series  - Vijeo Designer Basic Harmony/ Magelis HMISCU Series versions prior to 2.0.3

Harmony/ Magelis HMISCU Series

Harmony/ Magelis HMISCU Series 2.1.0

Schneider Electric Harmony/ Magelis HMISCU Series 2.1.0

CVE-2021-33485

Codesys have released a series of vulnerabilities affecting the Codesys Runtime, Development System and Gateway components. Additional details on these vulnerabilities can be found in the CODESYS advisories linked above.

CVE Description

E+PLC100 is no longer commercially available as of 2021.
Customers should immediately apply the recommended mitigations provided below to reduce the risk of exploit and contact Eurotherm support team for advice about migrating to other Eurotherm offers.

Version V1.4.0.0 of the E+PLC400 firmware is available and includes a fix for this vulnerability.
Please contact the Eurotherm Support team to obtain the firmware update.
Please be sure to include the following when contacting the support team:
• End Username, Company and Email Address
• Serial numbers of the devices to be upgraded
• Current E+PLC firmware version

Version V5.1.9.34 of Modicon M241/M251 Logic Controllers includes a fix for these vulnerabilities.
On the engineering workstation, update to latest version of EcoStruxure Machine Expert:
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-somachine/?parent-subcategory-id=5140&filter=business-1-industrial-automation-and-control
In order to complete the update on Modicon M241/M251 Logic Controllers, update to firmware version V5.1.9.34 or higher available within EcoStruxure Machine Expert. A reboot is needed.

CVE-2021-29241

CVE Description

Version V1.4.0.0 of the E+PLC Tools software is available and includes a fix for these vulnerabilities.
Access to the patch can be obtained through the Eurotherm support team

Vijeo Designer Basic V1.2.1 HotFix 4 includes a fix for this vulnerability. Please contact your Schneider Electric Customer Care Center to obtain the installer. To complete the update, connect to Harmony HMI and download the firmware using Vijeo Designer Basic V1.2.1 HotFix 4

Vijeo Designer Basic V1.2.1 HotFix 4 includes a fix for this vulnerability. Please contact your Schneider Electric Customer Care Center to obtain the installer.To complete the update, connect to Harmony HMI and download the firmware using Vijeo Designer Basic V1.2.1 HotFix 4

Schneider Electric is establishing a remediation plan that will include a fix for these vulnerabilities. We will update this document when the remediations are available. Until then, customers should immediately apply the recommended mitigations provided below to reduce the risk of exploit.

Version 2.1.0 of EcoStruxureTM Machine Expert includes a fix for this vulnerability.
On the engineering workstation, update to latest version of EcoStruxureTM Machine Expert.
To complete the update, connect to Harmony HMISCU and download the project file using EcoStruxure TM Machine Expert.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-somachine/?parent-subcategory-id=5140&filter=business-1-industrial-automation-and-control

Version V6.2 SP12 HotFix 4 of Vijeo Designer includes a fix for these vulnerabilities and can be updated through the Schneider Electric Software Update (SESU) application.
On the engineering workstation, update to V6.2 SP12 HotFix 4 (or above) of Vijeo Designer.
To complete the update, connect to Harmony HMI and download the project file using Vijeo Designer V6.2 SP12 HotFix 4.

CVE-2021-29240

CVE Description

CVE-2021-21863

CVE Description

V2.0.3 of EcoStruxure Machine Expert includes a fix for these vulnerabilities.
On the engineering workstation, update to latest version of EcoStruxure Machine Expert:
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-somachine/?parent-subcategory-id=5140&filter=business-1-industrial-automation-and-control

CVE-2021-21864

CVE Description

CVE-2021-21865

CVE Description

CVE-2021-21866

CVE Description

CVE-2021-21867

CVE Description

CVE-2021-21868

CVE Description


EcoStruxure™ Power Monitoring Expert

Summary: Original Release

Summary: EcoStruxure™ Power Monitoring Expert - SEVD-2022-011-07 PDF Version

Summary: EcoStruxure™ Power Monitoring Expert - SEVD-2022-011-07 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Power Monitoring
Expert product (PME).
EcoStruxure Power Monitoring Expert is on-premise software used to help power-critical and energy-intensive facilities maximize uptime and operational efficiency.
Failure to apply the remediation provided below may risk loss of data confidentiality, data integrity issues, or a loss of access to the server.

Overview

Schneider Electric

EcoStruxure Power Monitoring Exper

Schneider Electric EcoStruxure Power Monitoring Exper <=2020

EcoStruxure Power Monitoring Exper

2020 CU3

Schneider Electric EcoStruxure Power Monitoring Exper 2020 CU3

Schneider Electric EcoStruxure Power Monitoring Exper <=9.0

Schneider Electric EcoStruxure Power Monitoring Exper 2021

CVE-2022-22726

A CWE-20: Improper Input Validation vulnerability exists that could allow arbitrary files on the
server to be read by authenticated users through a limited operating system service account.

CVE Description

Remediation Steps:
1. Install Version 2020 CU3 of EcoStruxure Power Monitoring
Expert which includes a fix for CVE-2022-22726, CVE-2022-
22727, and CVE-2022-22804.
2. Install Floating License Manager 2.7 after PME 2020 CU3
installation to address CVE-2019-8963.
Both updates can be downloaded here:
https://schneiderelectric.app.box.com/folder/152201039971?s=dwbjm0bp3850ek95zyinv6g7nqjj86fm

Contact your Schneider Electric representative for details on how to
upgrade to PME 2021

CVE-2022-22727

A CWE-20: Improper Input Validation vulnerability exists that could allow an unauthenticated
attacker to view data, change settings, impact availability of the software, or potentially impact a
user’s local machine when the user clicks a specially crafted link.

CVE Description

CVE-2022-22804

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability exists that could allow an authenticated attacker to view data, change
settings, or impact availability of the software when the user visits a page containing the injected
payload.

CVE Description

CVE-2019-8963

A Denial of Service vulnerability exists in FlexNet Publisher's lmadmin tool, when doing a
crafted POST request on lmadmin using web-based tool. This tool is deployed with PME and an
attacker leveraging this vulnerability may be able, with a sustained attack, to stop PME from
operating

CVE Description


Summary: Original Release

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2022-039-01 PDF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2022-039-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the IGSS (Interactive Graphical SCADA
System) Data Server module.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling
industrial processes. The Data Server is a module with a TCP interface used by other modules
to access data of the SCADA System.
Failure to apply the remediations provided below may risk remote code execution, which could result in a variety of issues including disclosure of data and loss of control of the SCADA System with IGSS running in production mode.

Overview

Schneider Electric

IGSS Data Server (IGSSdataServer.exe)

Schneider Electric IGSS Data Server (IGSSdataServer.exe) <=15.0.0.22020

Schneider Electric IGSS Data Server (IGSSdataServer.exe) 15.0.0.22021

CVE-2022-24310

A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based
buffer overflow, leading to denial of service and potentially remote code execution when an
attacker sends multiple specially crafted messages.

CVE Description

Version 15.0.0.22021 of IGSS Data Server includes corrections for these vulnerabilities and is available for download through IGSS Master > Update IGSS Software or here:
https://igss.schneiderelectric.com/igss/igssupdates/v150/IGSSUPDATE.ZIP

CVE-2022-24311

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that
could cause modification of an existing file by inserting at beginning of file or create a new file in
the context of the Data Server potentially leading to remote code execution when an attacker
sends a specially crafted message.

CVE Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2022-24312

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that
could cause modification of an existing file by adding at end of file or create a new file in the
context of the Data Server potentially leading to remote code execution when an attacker sends
a specially crafted message.

CVE Description

CVE-2022-24313

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a
stack-based buffer overflow potentially leading to remote code execution when an attacker
sends a specially crafted message.

CVE Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-24314

A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially
resulting in denial of service when an attacker repeatedly sends a specially crafted message.

CVE Description

CVE-2022-24315

A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message.

CVE Description

CVE-2022-24316

A CWE-665: Improper Initialization vulnerability exists that could cause information
exposure when an attacker sends a specially crafted message.

CVE Description

CVE-2022-24317

A CWE-862: Missing Authorization vulnerability exists that could cause information
exposure when an attacker sends a specific message.

CVE Description


EcoStruxure EV Charging Expert

Summary: Original Release

Summary: November 2022 Update: The CWE for CVE-2022-22808 has been updated (marked in red). No additional action is required for customers who have already followed the remediation instructions provided below.

Summary: EcoStruxure EV Charging Expert - SEVD-2022-039-02 PDF Version

Summary: EcoStruxure EV Charging Expert - SEVD-2022-039-02 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure EV Charging Expert
(formerly known as EVlink Load Management System) products.
The EcoStruxure EV Charging Expert products are load management, access management and
supervision solutions for EV charging infrastructure.
Failure to apply the available remediations may risk potential unauthorized access to the
product’s web server, which could lead to tampering and compromise of the product’s settings
and accounts. Such tampering could lead to things like denial of service attacks, which could
result in unauthorized use of the managed EV charging stations, service interruptions, failure to
communicate with the supervision system and the modification and disclosure of the product’s
configuration.
In addition to applying the available remediations, to limit the risk of a product being
compromised, Schneider Electric recommends that customers follow and apply network security
best practices and ensure that the products are not accessible from the internet, as outlined in
the General Security Recommendations section

Overview

Schneider Electric

EcoStruxure EV Charging

<SP8 (Version 01) V4.0.0.13

Schneider Electric EcoStruxure EV Charging versions prior to SP8 (Version 01) V4.0.0.13

EcoStruxure EV Charging

SP8 (Version 01) V4.0.0.13

Schneider Electric EcoStruxure EV Charging SP8 (Version 01) V4.0.0.13

CVE-2022-22808

A CWE-352: Cross-Site Request Forgery vulnerability exists that could cause a remote attacker to gain unauthorized access to the product when conducting cross-domain attacks based on same-origin policy or cross-site request forgery protections bypass.

CVE Description

Version SP8 (Version 01) V4.0.0.13 of the EcoStruxure EV
Charging Expert product includes a fix for these vulnerabilities
and is available for download here:
https://www.se.com/ww/en/product-range/62159-
ecostruxure%E2%84%A2-ev-charging-expert/#software-andfirmware
The installation procedure requires a reboot of the product in
order to complete the update. After installation, the software
version can be checked through the operation interface in the
Updates tab.


Easergy P40

Summary: Original release

Summary: Easergy P40 - SEVD-2022-039-03 PDF Version

Summary: Easergy P40 - SEVD-2022-039-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Easergy P40 product line.
The Easergy P40 is a protection relay series for MV, HV and EHV protection.
Failure to apply the mitigation provided below may risk disclosure of device credentials, loss of communications, or an attacker gaining full control of the relay. This could result in loss of protection to your electrical network.

Overview

This advisory also applies to OpenSSL vulnerabilities (https://www.openssl.org/news/vulnerabilities.html)
An older version of Open SSL, a cryptographic cipher suite, is integrated in the Easergy P40 product. If an attacker were to take active control of the Courier tunneling communication network and exploit vulnerabilities in this library it may risk disclosure of device credentials, denial of service, or an attacker gaining full control of the relay. The CVSS score provided above reflects the worst case exploit of the known vulnerabilities present in the library.

Schneider Electric

Easergy P40 Series model numbers with Ethernet option bit as Q, R, S P_ 4_ _ _ Q_ _ _ _ _ _ _ _, P_ 4_ _ _ R_ _ _ _ _ _ _ _ , P_ 4_ _ _ S_ _ _ _ _ _ _ _

All PX4X firmware versions

Schneider Electric Easergy P40 Series model numbers with Ethernet option bit as Q, R, S All PX4X firmware versions

These vulnerabilities impact the secure Courier tunneling communication over Ethernet. This communication is only used for commissioning between the IED and Easergy Studio software. It is recommended to only use Courier tunneling with Easergy Studio software in a secured network and disable the logical port by disabling “Courier Tunnel” in settings when not in use.

A CWE-798: Use of Hard-coded Credentials vulnerability exists. If an attacker were to obtain the TLS cryptographic key and take active control of the Courier tunneling communication network, they could potentially observe and manipulate traffic associated with product configuration.


spaceLYnk, Wiser For KNX, fellerLYnk

Summary: Original release

Summary: March 2022 Update: The CVSS score has been updated for CVE-2022-22811 and CVE-2022-22812.

Summary: spaceLYnk, Wiser For KNX, fellerLYnk - SEVD-2022-039-04 PDF Version

Summary: spaceLYnk, Wiser For KNX, fellerLYnk - SEVD-2022-039-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its spaceLYnk, Wiser For KNX, and fellerLYnk products.
spaceLYnk is a centralized solution that reduces energy and maintenance costs, increases comfort and flexibility, and simplifies building management.
Wiser for KNX ,formerly known as homeLYnk, products are personalized energy efficiency solutions, offering a complete system based on open protocols: KNX, Modbus, BACnet and IP.
fellerLYnk offers more flexibility in visualization and trend recording as well as functions such as presence simulation or time switches that the end customer can easily manage.
Failure to apply the remediations provided below may risk a Cross-Site Request Forgery (CSRF), Missing Authentication, rate limit, or Stored Cross-Site Scripting (XSS) attack which could result in exfiltrated data and unauthorized access.
March 2022 Update: The CVSS score has been updated for CVE-2022-22811 and CVE-2022-22812

Overview

Schneider Electric

spaceLYnk

Schneider Electric spaceLYnk V2.6.2 and prior

Wiser for KNX (formerly homeLYnk)

Schneider Electric Wiser for KNX (formerly homeLYnk) V2.6.2 and prior

Schneider Electric Wiser for KNX (formerly homeLYnk) 2.7.0

fellerLYnk

Schneider Electric fellerLYnk V2.6.2 and prior

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touch configurations in an unauthorized manner when an attacker attempts to modify the touch configurations.

Version 2.7.0 of the spaceLYnk product includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product/LSS100200/spacelynk-logiccontroller/
A reboot is needed after installation.

Version 2.7.0 of the Wiser for KNX product includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product/LSS100100/wiser-for-knxlogic-controller/
A reboot is needed after installation.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch. If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • The homeLYnk, spaceLYnk, Wiser For KNX, fellerLYnk products should only be used in your personal home network. • The homeLYnk, spaceLYnk, Wiser For KNX, fellerLYnk products should not have a publicly accessible IP address. • Do NOT use port forwarding to access these products from the public internet. • These products should be on their own network segment. If your router supports a guest network or VLAN, it is preferable to locate the controller there. • Use the strongest Wi-Fi encryption available. • Use HTTPs in local network. • Only visit trusted websites.

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker to manipulate the admin after numerous attempts at guessing credentials.

Version 2.7.0 of the fellerLYnk product includes a fix for this vulnerability and is available for download here:
https://onlinekatalog.feller.ch/download/index.php?menueidLev1=279&menueidLev2=662&menueidLev3=664
A reboot is needed after installation.

Version 2.7.0 of the spaceLYnk product includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product/LSS100200/spacelynk-logiccontroller/.
A reboot is needed after installation.

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions, leading to the override of the system’s configurations when an attacker persuades a user to visit a rogue website

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a web session compromise when an attacker injects and then executes arbitrary malicious JavaScript code inside the target browser.


EcoStruxure Geo SCADA Expert

Summary: Original release

Summary: EcoStruxure Geo SCADA Expert - SEVD-2022-039-05 PDF Version

Summary: EcoStruxure Geo SCADA Expert - SEVD-2022-039-05 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Geo SCADA Expert product (formerly known as ClearSCADA).
EcoStruxure Geo SCADA Expert software is an open, flexible, and scalable software system for telemetry and remote SCADA solutions.
Failure to apply the remediations provided below may risk the impersonation of client activity or the revealing of account credentials, which could result in unauthorized system access.

Overview

Installation of new server software will require system restart or changeover of redundant servers. Consult the Release Notes and Exchange Knowledge Base (Resource Center) for
advice on the procedure:
https://community.exchange.se.com/t5/Geo-SCADA-Knowledge-Base/Resource-CenterHome/ba-p/279133
Please read the product documentation to understand how to set up client and server certificates and how to configure connections to restrict to client versions supporting certificates.
Customers should use appropriate update methodologies when applying these updates to their systems. We strongly recommend the use of back-ups and evaluating the impact of these updates in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing an update.

Schneider Electric

ClearSCADA

All versions

Schneider Electric ClearSCADA All versions

EcoStruxure Geo SCADA Expert 2019

All versions

Schneider Electric EcoStruxure Geo SCADA Expert 2019 All versions

EcoStruxure Geo SCADA Expert 2020

All versions

Schneider Electric EcoStruxure Geo SCADA Expert 2020 All versions

Geo SCADA Expert 2021

All versions (84.*)

Geo SCADA Expert 2021 All versions (84.*)

A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used.

The Geo SCADA Expert 2021 product includes fixes for all the above vulnerabilities and is
available for download here:
https://community.exchange.se.com/t5/Geo-SCADA-Knowledge-Base/Geo-SCADA-ExpertDownloads/ba-p/279115

Restrict access to the Geo SCADA server's database port (default 5481/TCP) and Geo SCADA Server’s web services port (default 443/TCP). Access should be available only
to ViewX and WebX client.

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-the Middle attack when communications between the client and Geo SCADA web server are intercepted

A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-the Middle attack when communications between the client and Geo SCADA database server are intercepted.

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request.


Summary: Original release

Summary: Harmony/Magelis iPC Series HMI, Vijeo Designer and Vijeo Designer Basic - SEVD-2022-039-06 PDF Version

Summary: Harmony/Magelis iPC Series HMI, Vijeo Designer and Vijeo Designer Basic - SEVD-2022-039-06 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in Harmony/Magelis iPC Series HMI, Vijeo Designer and Vijeo Designer Basic.
The Harmony/Magelis iPC Series HMI products are configured by Vijeo Designer software.
Vijeo Designer and Vijeo Designer Basic are software solutions for developing, configuring, and commissioning an entire machine in a single software environment.
Failure to apply the remediations provided below may risk unauthorized access to the base installation directory due to improper access control lists, which could result in local privilege escalation.

Overview

Schneider Electric

Harmony/Magelis iPC Series

All Versions

Schneider Electric Harmony/Magelis iPC Series All Versions

Version V6.2 SP11 Multi HotFix 4

Schneider Electric Harmony/Magelis iPC Series Version V6.2 SP11 Multi HotFix 4

Vijeo Designer

<=V6.2 SP11 Multiple HotFix 4

Schneider Electric Vijeo Designer All Versions prior to V6.2 SP11 Multiple HotFix 4

Version V6.2 SP11 Multi HotFix 4

Schneider Electric Vijeo Designer Version V6.2 SP11 Multi HotFix 4

Vijeo Designer Basic

Schneider Electric Vijeo Designer Basic All Versions prior to V1.2.1

Version 1.2.1

Schneider Electric Vijeo Designer Basic Version 1.2.1

Version V6.2 SP11 Multi HotFix 4 of Vijeo Designer
includes a fix for this vulnerability and can be updated
through the Schneider Electric Software Update (SESU)
application.
On the engineering workstation, update to V6.2 SP11 Multi HotFix 4 (or above) of Vijeo Designer. In order to complete the update, connect to Harmony iPC
Series HMI and download the project file using Vijeo
Designer V6.2 SP11 Multi HotFix 4.

Version v1.2.1 of Vijeo Designer Basic includes a fix for this
vulnerability.
Please contact your Schneider Electric Customer Care
Center to obtain the installer.

A CWE-276: Incorrect Default Permissions vulnerability exists that could cause unauthorized access to the base installation directory leading to local privilege escalation.


Summary: Orignal Release

Summary: EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, SCADAPack RemoteConnect™ for x70 - SEVD-2022-067-01 CSAF Version

Summary: EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, SCADAPack RemoteConnect™ for x70 - SEVD-2022-067-01 PDF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert, EcoStruxure™ Process Expert, SCADAPack RemoteConnect™ for x70 software products.
EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon M340, M580, M580S, Premium, Momentum and Quantum ranges.
EcoStruxure™ Process Expert is the next-generation process automation system to engineer, operate and maintain an entire plant, a Distributed Control System (DCS), designed especially for water, mining, cement, power generation, consumer packaged goods, chemical, and oil and gas applications.
The SCADAPack RemoteConnect™ for x70 product is a Windows-based application based on EcoStruxure™ Control Expert software components that provides a programming and configuration environment for the SCADAPack x70 RTU series, which is comprised of the SCADAPack 470, 474, 570, 574 and 575 Smart RTUs.
Failure to apply the remediations provided below may risk a Denial of Service attack, which could cause a disruption of communication between the Modicon controller and the engineering software.

June 2022 Update: Added SCADAPack RemoteConnect™ to the list of affected products, which is impacted on versions prior to R2.7.3 through the integration of EcoStruxure™ Control Expert.

Overview

Schneider Electric

EcoStruxure™ Control Expert

<=V15.0 SP1

Schneider Electric EcoStruxure™ Control Expert <=V15.0 SP1

Schneider Electric EcoStruxure™ Control Expert V15.1

EcoStruxure™ Process Expert

Schneider Electric EcoStruxure™ Process Expert <V2021

Schneider Electric EcoStruxure™ Process Expert 2021

SCADAPack RemoteConnect™ for x70

Schneider Electric SCADAPack RemoteConnect™ for x70 <R2.7.3

Schneider Electric SCADAPack RemoteConnect™ for x70 R2.7.3

CVE-2022-24322

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data.

CVE Description

Version 15.1 of EcoStruxure™ Control Expert includes a fix for these vulnerabilities and is available for download here:

https://www.se.com/ww/en/download/document/EcoStruxureControlExpert_V15.1/

Customers using Unity Pro should strongly consider migrating to EcoStruxure™ Control Expert.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
To mitigate the risks associated to Modbus weaknesses, users should immediately:
•	Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP

Version R2.7.3 of SCADAPack RemoteConnect includes a fix for this vulnerability and is available for download here:
RemoteConnect for the SCADAPack x70 | Schneider Electric Exchange Marketplace (se.com)
There is no need to reboot
Users no longer need to update the RemoteConnect application when there is a Control Expert update
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
To mitigate the risks associated to Modbus weaknesses, users should immediately:
•	Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP

CVE-2022-24323

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data.

CVE Description

Version 2021 of EcoStruxure™ Process Expert includes a fix for these vulnerabilities and is available for download here:

https://www.se.com/myschneider/documentsDownloadCenterDetail/in/en/EPE2021Release

It is recommended to first read the ReadMe in its entirety before proceeding with the software installation.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
To mitigate the risks associated to Modbus weaknesses, users should immediately:
•	Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP


APC Smart-UPS SMT, SMC, SMX, SCL, SRC, XU, XP, CSH2, SURTD, SMTL, SRT, and select SRTL Series

Summary: Original Release

Summary: Added SRTL series to affected products. Removed Smart-UPS series from available remediations section as only SmartConnect currently has available remediations.

Summary: Added SRC & XU series to affected products. Added SmartConnect SMTL, SCL, and SMX Series in available remediations section

Summary: Added XP, SURTD, CHS2 series to affected products section and added Smart-UPS SCL and SRT Series in the available remediations section. Various changes were made to improve clarity.

Summary: SMT Series ID=1039: UPS 14.9 and prior and SMC Series ID=1041: UPS 14.9 and prior added to the Affected Products and Versions section (page 2). Added SRC and XU to the available remediations section (page 6). Various changes were made to improve clarity

Summary: In the Affected Products and Versions section, new series IDs were added to SMT, SMC, and SMX. Added CSH2 to the available remediations sections.   Added mitigations for products with the specified IDs that have been phased out and will not have firmware remediation.

Summary: SURTD series was removed from the affected products table after a further investigation concluded that it was not affected by CVE-2022-0715. SRTL series was added to the available remediation section. In addition, SMC/SMX/SMT series was added to the available remediation section and SRC series moved to separate remediation sections .

Summary: APC Smart-UPS SMT, SMC, SMX, SCL, SRC, XU, SMTL, SRT, and select SRTL Series - SEVD-2022-067-02 CSAF Version

Summary: APC Smart-UPS SMT, SMC, SMX, SCL, SRC, XU, SMTL, SRT, and select SRTL Series - SEVD-2022-067-02 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of the vulnerabilities associated with APC Smart-UPS uninterruptable power supply devices which, if compromised, may allow for potential unauthorized access and control of the device. Upon learning of these vulnerabilities, we worked diligently to develop remediations and mitigations, and disclose in a timely, responsible manner so that our customers and end-users can better protect their people, assets, and operations.
At Schneider Electric, the safety of our customers and products is our highest priority. We develop and manufacture our products to the highest safety standards in accordance with regulatory and industry guidelines. Our UPS products are compliant to these standards, ensuring they operate in a safe manner including conducting abnormal tests where components are intentionally faulted.
Our UPS units comply with industry safety standards including UL 1778, CSA 22.2 No. 107.3 in North America and IEC 62040-1 which references to generic standards CSA-C22.2 No. 60950-1 /UL 60950-1or IEC 60950-1 / IEC 62477-1.
We recommend that customers immediately install available firmware updates provided below, which include remediations to reduce the risk of successful exploitation of these vulnerabilities. In addition, customers should also immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from exploitation of these vulnerabilities. Where appropriate, this includes locating their systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks. More information on recommended security practices can be found in the General Security Recommendations section below.
Please subscribe to the Schneider Electric security notification service to be informed of updates to this notification https://www.schneider-electric.com/en/work/support/cybersecurity/security-notifications.jsp
For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center.
November 2022 Update: SURTD series was removed from the affected products table after a further investigation concluded that it was not affected by CVE-2022-0715. SRTL series was added to the available remediation section. In addition, SMC/SMX/SMT series was added to the available remediation section and SRC series moved to separate remediation sections.

Overview

Schneider Electric

Smart-UPS Family

SMT Series

ID= 14/17

<=UPS 14.9

Schneider Electric Smart-UPS Family SMT Series ID= 14/17 versions UPS 14.9 and prior

ID= 20

<=UPS 14.9

Schneider Electric Smart-UPS Family SMT Series ID= 20 versions UPS 14.9 and prior

ID= 1041

<=UPS 14.9

Schneider Electric Smart-UPS Family SMT Series ID= 1041 verions UPS 14.9 and prior

<=UPS 14.9

Schneider Electric Smart-UPS Family SMT Series ID=18 versions UPS 14.9 and prior

Schneider Electric Smart-UPS Family SMT Series ID=1040 versions UPS 14.9 and prior

Schneider Electric Smart-UPS Family SMT Series ID=1031 verssions UPS 14.9 and prior

ID = 1039

Schneider Electric Smart-UPS Family SMT Series ID = 1039 <=UPS 14.9

SMC Series

<=UPS 14.9

Schneider Electric Smart-UPS Family SMC Series ID=1000 <=UPS 14.9

Schneider Electric Smart-UPS Family SMC Series ID=1005 <=UPS 14.9

Schneider Electric Smart-UPS Family SMC Series ID=1007 <=UPS 14.9

ID = 1008

Schneider Electric Smart-UPS Family SMC Series ID = 1008 <=UPS 14.9

SCL Series

<=UPS 14.9

Schneider Electric Smart-UPS Family SCL Series ID=1036 <=UPS 14.9

Schneider Electric Smart-UPS Family SCL Series ID=1029 <=UPS 14.9

Schneider Electric Smart-UPS Family SCL Series ID=1037 <=UPS 14.9

SMX Series

<=UPS 14.9

Schneider Electric Smart-UPS Family SMX Series ID=10/11 <=UPS 14.9

Schneider Electric Smart-UPS Family SMX Series ID=1012 <=UPS 14.9

Schneider Electric Smart-UPS Family SMX Series ID=20 <=UPS 14.9

Schneider Electric Smart-UPS Family SMX Series ID=23 <=UPS 14.9

Schneider Electric Smart-UPS Family SMX Series ID=1023 <=UPS 14.9

Schneider Electric Smart-UPS Family SMX Series ID=1003 <=UPS 14.9

Schneider Electric Smart-UPS Family SMX Series ID=1031 <=UPS 14.9

SRT Series

<=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1010 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1019 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1025 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1020 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1021 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1001 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1013 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1002 <=UPS 14.9

Schneider Electric Smart-UPS Family SRT Series ID=1014 <=UPS 14.9

SRTL Series

<=UPS 14.9

Schneider Electric Smart-UPS Family SRTL Series SMT Series ID=1024 <=UPS 14.9

SRC Series

<=UPS 13.9

Schneider Electric Smart-UPS Family SRC Series ID=1004 <=UPS 13.9

Schneider Electric Smart-UPS Family SRC Series ID=1006 <=UPS 13.9

Schneider Electric Smart-UPS Family SRC Series ID=1011 <=UPS 13.9

XU Series

<=UPS 02.6

Schneider Electric Smart-UPS Family XU Series ID=1017 <=UPS 02.6

<=UPS 00.3

Schneider Electric Smart-UPS Family XU Series ID=1033 <=UPS 00.3

XP Series

<=UPS 02.3

Schneider Electric Smart-UPS Family XP Series ID=1016 <=UPS 02.3

CHS2 Series

<=UPS 14.9

Schneider Electric Smart-UPS Family CHS2 Series ID=5008 <=UPS 14.9

SURTD Series

<=UPS 14.9

Schneider Electric Smart-UPS Family SURTD Series ID=5 <=UPS 02.6

Schneider Electric Smart-UPS Family SURTD Series ID=9 <=UPS 00.3

SmartConnect Family

SMT Series

<=UPS 04.5

Schneider Electric SmartConnect Family SMT Series ID=1015 <=UPS 04.5

UPS 04.6

Schneider Electric SmartConnect Family SMT Series ID=1015 UPS 04.6

<=UPS 14.9

Schneider Electric SmartConnect Family SMT Series ID=1031 <=UPS 14.9

UPS 04.6

Schneider Electric SmartConnect Family SMT Series ID=1031 UPS 04.6

SMC Series

<=UPS 04.2

Schneider Electric SmartConnect Family SMC Series ID=1018 <=UPS 04.2

UPS 04.3

Schneider Electric SmartConnect Family SMC Series ID=1018 UPS 04.3

SMTL Series

<=UPS 14.9

Schneider Electric SmartConnect Family SMTL Series ID=1026 <=UPS 14.9

UPS 15.0

Schneider Electric SmartConnect Family SMTL Series ID=1026 UPS 15.0

SCL Series

<=UPS 14.9

Schneider Electric SmartConnect Family SCL Series ID=1030 <=UPS 14.9

UPS 15.0

Schneider Electric SmartConnect Family SCL Series ID=1030 UPS 15.0

SMX Series

<=UPS 14.9

Schneider Electric SmartConnect Family SMX Series ID=1031 <=UPS 14.9

UPS 15.0

Schneider Electric SmartConnect Family SMX Series ID=1031 UPS 15.0

CVE-2022-22805

A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled.

CVE Description

Firmware Version UPS 04.6 (SMT series), Version UPS 15.0 (SMTL, SCL, SMX series) and Version UPS 04.3 (SMC series) includes a partial remediation for CVE-2022-0715, which will reduce the risk of successful exploitation, for the Smart-UPS SMT and SMC series and a fix for CVE-2022-22805 and CVE-2022-22806 for the SmartConnect UPS SMT, SMTL, SCL, SMX series and SMC series.There are three ways to apply this remediation: 1.   For units connected to the SmartConnect Portal, new firmware will become available automatically. Follow prompts via the portal or display to install new firmware. 2. For units not connected to the SmartConnect Portal, use the Firmware Upgrade Wizard to install the new firmware.  3. For those devices which include a NMC, it can be used to remotely update the firmware of the UPS. When downloading updates, only download from the official Schneider Electric sources above and ensure that hashes are verified before installation.Note: After the firmware is installed, the unit will lose the capability to install future firmware via the NMC. All other methods of firmware update will continue to be available. A future firmware update will be released to re-enable this feature. To verify new firmware version post-installation: Go to the About screen on local display, the SmartConnect portal, or on the NMC and confirm that the UPS firmware Revision is UPS 04.6 (SMT series) and UPS 04.3 (SMC series)In addition to the remediations above, customers should immediately apply the General Security Recommendations provided below to reduce the risk of exploit.

Firmware Version UPS 04.6 (SMT series) and Version UPS 04.3 (SMC series) includes a partial remediation for CVE-2022-0715, which will reduce the risk of successful exploitation, for the Smart-UPS SMT and SMC series and a fix for CVE-2022-22805 and CVE-2022-22806 for the SmartConnect UPS SMT and SMC series.
There are three ways to apply this remediation:
1. For units connected to the SmartConnect Portal, new firmware will become available automatically. Follow prompts via the portal or display to install new firmware.
2. For units not connected to the SmartConnect Portal, use the Firmware Upgrade Wizard to install the new firmware.
3. For those devices which include a NMC, it can be used to remotely update the firmware of the UPS.
When downloading updates, only download from the official Schneider Electric sources above and ensure that hashes are verified before installation.
Note: After the firmware is installed, the unit will lose the capability to install future firmware via the NMC. All other methods of firmware update will continue to be available. A future firmware update will be released to re-enable this feature.
To verify new firmware version post-installation: Go to the About screen on local display, the SmartConnect portal, or on the NMC and confirm that the UPS firmware Revision is UPS 04.6 (SMT series) and UPS 04.3 (SMC series)
In addition to the remediations above, customers should immediately apply the General Security Recommendations provided below to reduce the risk of exploit.

Firmware Version UPS 15.0 includes a partial remediation for CVE-2022-0715, which will reduce the risk of successful exploitation and a fix for CVE-2022-22805 and CVE-2022-22806 for the SmartConnect UPS SMTL, SCL and SMX series.
There are three ways to apply this remediation:
1. For units connected to the SmartConnect Portal, new firmware will become available automatically. Follow prompts via the portal or display to install new firmware.
2. For units not connected to the SmartConnect Portal, use the Firmware Upgrade Wizard to install the new firmware.
3. For those devices which include a NMC, it can be used to remotely update the firmware of the UPS.
When downloading updates, only download from the official Schneider Electric sources above and ensure that hashes are verified before installation.
Note: After the firmware is installed, the unit will lose the capability to install future firmware via the NMC. All other methods of firmware update will continue to be available. A future firmware update will be released to re-enable this feature.
To verify new firmware version post-installation: Go to the About screen on local display, the SmartConnect portal, or on the NMC and confirm that the UPS firmware Revision is UPS 15.0. In addition to the remediations above, customers should immediately apply the General Security Recommendations provided below to reduce the risk of exploit.

CVE-2022-22806

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent.

CVE Description

CVE-2022-0715

A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS if a key is leaked and used to upload malicious firmware.

CVE Description

For Connected Devices:
CVSS v3.1 Base Score 8.9 | High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:H
For Non-Connected Devices:
CVSS v3.1 Base Score 6.9 | Medium | CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:H

CVE Details

Firmware Version UPS 15.0 (SRT, SRTL,  CSH2, & XU series) and Firmware Version UPS 15.1 (SCL series) includes a partial remediation for CVE-2022-0715, which will reduce the risk of successful exploitation for the Smart-UPS SCL,  SRTL, CSH2, XU,  and SRT series.There are two ways to apply this remediation: 1. For all units, use the Firmware Upgrade Wizard t o install the new firmware.  2. For those devices which include a NMC, it can be used to remotely update the firmware of the UPS. When downloading updates, only download from the official Schneider Electric sources above and ensure that hashes are verified before installation.Note: After the firmware is installed, the unit will lose the capability to install future firmware via the NMC. All other methods of firmware update will continue to be available. A future firmware update will be released to re-enable this feature. To verify new firmware version post-installation: Go to the About screen on local display, or on the NMC and confirm that the UPS firmware Revision is UPS 15.0. In addition to the remediations above, customers should immediately apply the General Security Recommendations provided below to reduce the risk of exploit.

Firmware Version UPS 15.0 (SRC) includes a partial remediation for CVE-2022-0715, which will reduce the risk of successful exploitation for the Smart-UPS SRC series.There are two ways to apply this remediation: 1. For all units, use the Firmware Upgrade Wizard to install the new firmware.  2. For those devices which include a NMC, it can be used to remotely update the firmware of the UPS. When downloading updates, only download from the official Schneider Electric sources above and ensure that hashes are verified before installation.Note: After the firmware is installed, the unit will lose the capability to install future firmware via the NMC. All other methods of firmware update will continue to be available. A future firmware update will be released to re-enable this feature. To verify new firmware version post-installation: Go to the About screen on local display, or on the NMC and confirm that the UPS firmware Revision is UPS 15.0. In addition to the remediations above, customers should immediately apply the General Security Recommendations provided below to reduce the risk of exploit.

Firmware Version UPS 15.0 (SMT, SMC, SMX, XP series) includes a partial remediation for CVE-2022-0715, which will reduce the risk of successful exploitation for the Smart-UPS SMT, SMC, SMX, XP series. There are two ways to apply this remediation: 1. For all units, use the Firmware Upgrade Wizard to install the new firmware.  2. For those devices which include a NMC, it can be used to remotely update the firmware of the UPS. When downloading updates, only download from the official Schneider Electric sources above and ensure that hashes are verified before installation.Note: After the firmware is installed, the unit will lose the capability to install future firmware via the NMC. All other methods of firmware update will continue to be available. A future firmware update will be released to re-enable this feature. To verify new firmware version post-installation: Go to the About screen on local display, or on the NMC and confirm that the UPS firmware Revision is UPS 15.0. In addition to the remediations above, customers should immediately apply the General Security Recommendations provided below to reduce the risk of exploit.

UPS models from these series with the specified IDs have been phased out and firmware remediation is not available for them. To reduce the risk of exploit, customers should continue to follow the General Security Recommendations.To remediate the vulnerabilities, we recommend that you replace UPS models with the specified IDs with a newer version of a similar model. If you have questions about which model you should procure, please reach out to your account manager or refer to the UPS Selector and Product Substitution & Replacements tools at www.apc.com.


Ritto Wiser™ Door

Summary: Original Release

Summary: Ritto Wiser™ Door - SEVD-2022-067-03 PDF Version

Summary: Ritto Wiser™ Door - SEVD-2022-067-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability impacting its Ritto Wiser™ Door product. The Ritto Wiser™ Door provides convenient door communication: stationary via the highresolution, large-format panel or gateway in the sub-distribution and mobile via an app on smartphone or tablet.  We recommend that the below mitigations are put in place to reduce exposure to threat actors who may utilize this vulnerability to unlock a physical door.

Overview

Schneider Electric

Ritto Wiser™ Door

All versions

Schneider Electric Ritto Wiser™ Door All versions

CVE-2021-22783

A CWE-200: Information Exposure vulnerability exists which could allow a session hijack when the door panel is communicating with the door.

CVE Description

Exposure of Sensitive Information to an Unauthorized Actor

Due to product limitations, a firmware update cannot be provided for the large format panel or gateway. A mobile update has been released to provide a warning to customers to use a secure connection. Customers should immediately apply the following mitigations to reduce the risk of exploit: Ensure the touch panel and all mobile devices connected to the Wiser™ Door system is used in a trustworthy, properly segmented, Wi-Fi environment with strong communication security such as WPA2 or better. When outside of a trusted Wi-Fi environment, we strongly recommend the use of a secure communication channel, like a secure VPN service, to remotely access the product. Customers will receive reminders to utilize secure VPNs upon opening the Ritto Wiser™ Door app. For residential use, we recommend placing this product on a segmented network separate from the main home Wi-Fi to ensure privacy and security.


SCADAPack Workbench

Summary: Original Release

Summary: Remediation for the SCADAPack Workbench is available for download (page 1).

Summary: SCADAPack Workbench - SEVD-2022-087-01 PDF Version

Summary: SCADAPack Workbench - SEVD-2022-087-01 CSAF Version

Public

General Security Recommendations

The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Note regarding vulnerability details

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its SCADAPack Workbench product.
SCADAPack Workbench is a programming and configuration tool for SCADAPack 300E RTUs and SCADAPack 500E RTUs.
Failure to apply the mitigations provided below may risk information disclosure, which could result from exfiltration of data from local files to a remote system controlled by an attacker.
April 2023 Update: A remediation for the SCADAPack Workbench is available for download (page 1).

Overview

Schneider Electric

SCADAPack Workbench

Schneider Electric SCADAPack Workbench versions 6.6.8a and prior

Schneider Electric SCADAPack Workbench 6.6.10

CVE-2022-0221

A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker.

CVE Description

Version 6.6.10 of SCADAPack Workbench includes a fix for this vulnerability and is available for download here:
https://shop.exchange.se.com/en-US/apps/62860/scadapack-workbench-and-utilities
Please follow the instructions on the download page for installation.


Summary: Original Release

Summary: An additional vulnerability was remediated with the released patch.

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2022-102-01 CSAF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2022-102-01 PDF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Data Server module for the IGSS (Interactive Graphical SCADA System) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. The Data Server is a module with a TCP interface used by other modules to access data of the SCADA System.
Failure to apply the remediations provided below may risk remote code execution, which could result in a variety of issues including disclosure of data and loss of control of the SCADA System with IGSS running in production mode. July 12, 2022 Update: An additional vulnerability, CVE-2022-2329, was remediated with the released patch.

Overview

Schneider Electric

IGSS Data Server (IGSSdataServer.exe)

Schneider Electric IGSS Data Server (IGSSdataServer.exe) version 15.0.0.22073 and prior

Schneider Electric IGSS Data Server (IGSSdataServer.exe) 15.0.0.22074

CVE-2022-24324

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message.

CVE Description

Version 15.0.0.22074 of IGSS Data Server includes a correction for this vulnerability and is available for download through IGSS Master > Update IGSS Software or here:
https://igss.schneider-electric.com/igss/igssupdates/v150/IGSSUPDATE.ZIP

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Follow the general security recommendation below and verify that devices are isolated on a private network and that firewalls are configured with strict boundaries for devices that require remote access.

CVE-2022-2329

A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages.

CVE Description


Summary: Original Release

Summary: A remediation is available for Modicon M340 X80 Ethernet Communication Module BMXNOR0200H RTU.

Summary: Clarification on Modicon M340 CPUs version.

Summary: Modicon M340 Controller and Communication Modules - SEVD-2022-102-02 PDF Version

Summary: Modicon M340 Controller and Communication Modules - SEVD-2022-102-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon M340 Controller and Communication Modules. The Modicon M340 offers compactness, flexibility, scalability, and robustness for the process industry and a wide range of demanding automation applications. Failure to apply the remediation and mitigations provided below may risk Denial of Service to the Ethernet communication, which could result in a loss of availability of the controller.

Overview

Schneider Electric

Modicon M340 CPUs

Schneider Electric Modicon M340 CPUs BMXP34* versions prior to v3.50

Schneider Electric Modicon M340 CPUs version 3.50

Modicon M340 X80 Ethernet Communication module BMXNOE0100 (H)

Schneider Electric Modicon M340 X80 Ethernet Communication modules BMXNOE0100 (H) versions prior to SV03.50

Schneider Electric Modicon M340 X80 Ethernet Communication modules BMXNOE0100 (H) SV03.50

Modicon M340 X80 Ethernet Communication module BMXNOE0110 (H)

Schneider Electric Modicon M340 X80 Ethernet Communication modules BMXNOE0110 (H) versions prior to SV06.70

Schneider Electric Modicon M340 X80 Ethernet Communication modules BMXNOE0110 (H) SV06.70

<1.7 IR24

Modicon M340 X80 Ethernet Communication modules <1.7 IR24

1.7 IR24

Modicon M340 X80 Ethernet Communication modules 1.7 IR24

CVE-2022-0222

A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP.

CVE Description

Version 3.50 of Modicon M340 includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.
50/
If customers choose not to apply the remediation provided above, they
should immediately apply the following mitigations to reduce the risk of
exploit:
• Setup network segmentation and implement a firewall to block
all unauthorized access to port 161/UDP.
• Configure the Access Control List following the
recommendations of the user manual “Modicon M340 for
Ethernet Communications Modules and Processors User
Manual” in chapter “Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K010
00/
• Setup a VPN between the Modicon PLC impacted modules and
the engineering workstation containing EcoStruxure Control
Expert.

Modicon M340 X80 Ethernet Communication Module BMXNOR0200H V1.7 IR24 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/product/BMXNOR0200H/ethernet-serial-rtu-module-2-x-rj45/
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 161/UDP.
• Setup a VPN between the Modicon PLC impacted modules and the engineering workstation containing EcoStruxure Control Expert.

Version SV03.50of BMXNOE0100 (H) includes a fix for thesevulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/BMXNOE0100_SV_03.50/

Version SV06.70 of BMXNOE0110 (H) includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/download/document/BMXNOE0110_SV_06.70/

If customers choose not to apply the remediation, then they should immediately apply the following mitigations to reduce the risk of exploit: •Setup network segmentation and implement a firewall to block all unauthorized access to port 80/HTTP (Note HTTP is disabled by default). •Configure the Access Control List following the recommendations of the user manual “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/•Setup a VPN between the Modicon PLC impacted modules and the engineering workstation containing EcoStruxure Control Expertor Process Expert.


PowerLogic ION Setup

Summary: Original Release

Summary: PowerLogic ION Setup - SEVD-2022-130-01 CSAF Version

Summary: PowerLogic ION Setup - SEVD-2022-130-01 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its PowerLogic ION Setup product.
The PowerLogic ION Setup product is an engineering tool for configuration and maintenance of PowerLogic metering devices.
Failure to apply the remediations provided below may risk remote code execution, which could result in a compromise of the engineering workstation running the ION Setup software.

Overview

Schneider Electric

PowerLogic ION Setup

Schneider Electric PowerLogic ION Setup versions prior to 3.2.22096.01

Schneider Electric PowerLogic ION Setup 3.2.22096.01

CVE-2022-30232

A CWE-20: Improper Input Validation vulnerability exists that could cause potential remote code execution when an attacker is able to intercept and modify a request on the same network or has configuration access to an ION device on the network.

CVE Description

Version 3.2.22096.01 of PowerLogic ION Setup includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/ION_Setup_Latest_Release/
Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.


Saitel DP RTU

Summary: Original Release

Summary: Saitel DP RTU - SEVD-2022-130-02 CSAF Version

Summary: Saitel DP RTU - SEVD-2022-130-02 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Triangle MicroWorks DNP3 Outstation Libraries used in the Saitel DP RTU (Remote Terminal Unit).
The Saitel DP RTU (Remote Terminal Unit) is a modular platform for medium voltage and low voltage public distribution and transmission network management.
Failure to apply the mitigations provided below may lead to a denial of service of the DNP3 communication resulting in a loss of remote access or a reboot of the device.

Overview

Schneider Electric

Saitel DP RTU

Schneider Electric Saitel DP BaseLine>=11.06.23|<=09.00.00

Schneider Electric Saitel DP RTU BaseLine 11.06.24

CVE-2020-6996

In the context of the Saitel DP RTU the vulnerability may lead to denial of service when an attacker gains access to the RTU communication network. CVSS score, provided above, is evaluated as Medium in the product context.
Further information on this CVE can be found at https://nvd.nist.gov/vuln/detail/CVE-2020-6996.

CVE Description

Saitel DP RTU BaseLine_11.06.24 includes a fix for this vulnerability and is available from your Schneider Electric Saitel sales contact.


Wiser Smart

Summary: Original Release

Summary: Wiser Smart - SEVD-2022-130-03 CSAF Version

Summary: Wiser Smart - SEVD-2022-130-03 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Wiser Smart products.
The Wiser Smart [EER21000 and EER21001] products is a home automation system which reports your energy consumption and controls the most energy consuming devices.
Failure to apply the mitigations provided below may risk root level access attack, which could result in execution of arbitrary code.

Overview

Schneider Electric

Wiser Smart

Schneider Electric Wiser Smart version 4.5 and prior

Schneider Electric Wiser Smart versions 4.5 and prior

CVE-2022-30234

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtained

CVE Description

Wiser Smart [EER21000 and EER21001] products have reached its end of life and is no longer supported. Customers should immediately apply the following mitigations to reduce the risk of exploit:
• These controller products should not have a publicly or Internet accessible IP address.
• Do NOT use port forwarding to access these products from the public Internet.
• These products should be on their own network segment. If your router supports a VLAN, it is preferable to locate the controller there.
• Use the strongest Wi-Fi encryption available.
• Never re-use passwords.
• Use HTTPS in local network.
• Only visit trusted websites.

CVE-2022-30235

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized access when an attacker uses brute force.

CVE Description

CVE-2022-30238

A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account when an attacker hijacks a session

CVE Description

CVE-2022-30236

A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when an attacker uses cross-domain attacks.

CVE Description

CVE-2022-30237

A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be recovered when an attacker breaks the encoding.

CVE Description

CVE-2022-30233

A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated when the user is tricked into performing certain actions on a webpage.

CVE Description


Summary: Original Release

Summary: The affected versions have been updated to include versions up to V15.0.0.22170.

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2022-165-01 CSAF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2022-165-01 PDF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Data Server module for the IGSS (Interactive Graphical SCADA System) product.

The IGSS product is a SCADA system used for monitoring and controlling industrial processes. The Data Server is a module with a TCP interface used by other modules to access data of the SCADA System.

Failure to apply the remediation provided below may result in denial of service and data files in the IGSS Report folder being lost, added, changed, or exposed. Further, it may risk remote code execution, which could result in various issues, including disclosure of data and loss of control of the SCADA System with IGSS running in production mode.
The CVE-2022-32528 description details have been clarified (page 2).

Overview

Schneider Electric

IGSS Data Server (IGSSdataServer.exe)

Schneider Electric IGSS Data Server (IGSSdataServer.exe) version V15.0.0.22139 and prior

Schneider Electric IGSS Data Server (IGSSdataServer.exe) V15.0.0.22140

CVE-2022-32528

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project report directory, potentially leading to a denial-of-service condition when an attacker sends specific messages.

CVE Description

V15.0.0.22171 of IGSS Data Server includes a fix for these vulnerabilities and is available for download through IGSS Master > Update IGSS Software or here:
Online IGSS Updates Page:
https://igss.schneider-electric.com/licensed-versions/
Direct Download:
https://igss.schneider-electric.com/igss/igssupdates/v150/IGSSUPDATE.ZIP

CVE-2022-32522

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted mathematically reduced data request messages.

CVE Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2022-32523

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted online data request messages.

CVE Description

CVE-2022-32524

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted time reduced data messages.

CVE Description

CVE-2022-32525

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm data messages.

CVE Description

CVE-2022-32526

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted setting value messages.

CVE Description

CVE-2022-32527

CVE Description

CVE-2022-32529

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code execution when an attacker sends specially crafted alarm cache data messages.

CVE Description


Geo SCADA Mobile

Summary: Original Release

Summary: Geo SCADA Mobile - SEVD-2022-165-02 CSAF Version

Summary: Geo SCADA Mobile - SEVD-2022-165-02 PDF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure Geo SCADA Mobile product.
The Geo SCADA Mobile product is an Android mobile app which provides remote access to data within a Geo SCADA Expert system when used via the optional Geo SCADA Mobile Server.
Failure to apply the remediations provided below may risk users requesting unintended actions, which could result in incorrect data being displayed, incorrect alarm acknowledgements, or (if plant controls are permitted) execution of the wrong plant control.

Overview

Schneider Electric

Geo SCADA Mobile

Schneider Electric Geo SCADA Mobile <=222

Schneider Electric Geo SCADA Mobile 202205171

CVE-2022-32530

A CWE-668 Exposure of Resource to Wrong Sphere vulnerability exists that could cause users to be misled, hiding alarms, showing the wrong server connection option or the wrong control request when a mobile device has been compromised by a malicious application.

CVE Description

Build 202205171 of Geo SCADA Mobile includes a fix for this vulnerability and is available for download here:
https://play.google.com/store/apps/details?id=com.schneidertcc.android.apps.mobilescada&gl=US

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
On the Geo SCADA Mobile Server, remove the permissions for Alarm Acknowledge and Control from mobile users.


Conext™ Combox

Summary: Original Release

Summary: Conext™ Combox - SEVD-2022-165-03 CSAF Version

Summary: Conext™ Combox - SEVD-2022-165-03 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Conext™ ComBox product which was discontinued in January 2020 and is no longer in support.
The Conext™ ComBox is a communication and monitoring device for installers and operators of Conext solar systems. It features an integrated web server, enabling graphical displays of system daily, monthly and lifetime energy data to be viewed using a simple web browser or Android tablet device.
Failure to apply the mitigations provided below may risk Clickjacking, Rate Limiting & Cross-Site Request Forgery attacks. An attacker who successfully exploits one or more of these vulnerabilities could trick the product user/admin into performing unintended actions that may lead to taking over their account or manipulating the station settings.

Overview

Schneider Electric

Conext™ ComBox

All Versions

Schneider Electric Conext™ ComBox All Versions

CVE-2022-32515

A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account when the product does not implement a rate limit mechanism on the admin authentication form

CVE Description

Conext™ ComBox product was discontinued as of January 2020 and is no longer in support. Customers should immediately apply the following mitigations to reduce the risk of exploit:
 Do not expose the Conext™ Combox directly to the Internet
 Do not grant network access to unknown computers
 Computer(s) must be kept up to date with the latest security patches
 Customers should also consider upgrading to the latest product offering InsightHome & InsightFacility to resolve these issues.

CVE-2022-32516

A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product suffers from POST-Based Cross-Site Request Forgery (CSRF)

CVE Description

CVE-2022-32517

A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into interacting with the application in an unintended way when the product does not implement restrictions on the ability to render within frames on external addresses

CVE Description