EcoStruxure Geo SCADA Expert

Summary: Original Release

Summary: EcoStruxure Geo SCADA Expert - SEVD-2020-343-02 PDF Version

Summary: EcoStruxure Geo SCADA Expert - SEVD-2020-343-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Schneider Electric EcoStruxure Geo SCADA
Expert product.
EcoStruxure Geo SCADA Expert software is an integrated, scalable and reliable Supervisory
Control and Data Acquisition (SCADA) software with ready-to-use telemetry features optimized
for managing remote assets spread across geographically dispersed infrastructure.
Failure to apply the remediations provided below may risk the revealing of account credentials,
which could result in unauthorized system access.

Overview

Schneider Electric

EcoStruxure Geo SCADA Expert 2019

Schneider Electric EcoStruxure Geo SCADA Expert 2019 Original release and Monthly Updates to September 2020, from 81.7268.1 to 81.7578.1

EcoStruxure Geo SCADA Expert 2020

Schneider Electric EcoStruxure Geo SCADA Expert 2020 Original release and Monthly Updates to September 2020, from 83.7551.1 to 83.7578.1

EcoStruxure Geo SCADA Expert 2019

Schneider Electric EcoStruxure Geo SCADA Expert 2019 Monthly Updates from October 2020, 81.7613.1

EcoStruxure Geo SCADA Expert 2020

Schneider Electric EcoStruxure Geo SCADA Expert 2020 Monthly Updates from October 2020, 83.7613.1

CVE-2020-28219

CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause exposure
of credentials to server-side users when web users are logged in to Virtual ViewX.

CVE Description

The Monthly Updates from October 2020, 81.7613.1 include a fix for
this vulnerability.
Software is available for download here: https://tprojects.schneiderelectric.com/telemetry/display/CS/Geo+SCADA+Expert+Downloads. If Virtual ViewX is on a separate server from the Geo SCADA Server, then only Virtual ViewX software requires installation, although it is recommended to keep both up to date. If on the same server as the Geo SCADA Server then both components require update. Software updates may require reboots as requested. This software update makes changes to the Virtual ViewX settings which can be performed manually. To do this and verify that the settings are in place, refer to the mitigation steps below. Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance removing a patch. The steps to remediate this vulnerability are automatically applied by the October Monthly Updates.

The Monthly Updates from October 2020, 83.7613.1 include a fix for
this vulnerability.
Software is available for download here: https://tprojects.schneiderelectric.com/telemetry/display/CS/Geo+SCADA+Expert+Downloads. If Virtual ViewX is on a separate server from the Geo SCADA Server, then only Virtual ViewX software requires installation, although it is recommended to keep both up to date. If on the same server as the Geo SCADA Server then both components require update. Software updates may require reboots as requested. This software update makes changes to the Virtual ViewX settings which can be performed manually. To do this and verify that the settings are in place, refer to the mitigation steps below. Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance removing a patch. The steps to remediate this vulnerability are automatically applied by the October Monthly Updates.

 If customers choose not to update to the latest software, they should immediately
follow these steps:
1. From the Virtual ViewX Manager app, select the 'Applications' tab.
2. Double-click the Virtual ViewX application in the list.
3. Then uncheck the setting 'Allow Browser Arguments'.
4. Finally click OK, then Apply and Close.


Summary: Original Release

Summary: Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (V2.0) - SEVD-2020-343-04 PDF Version

Summary: Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules (V2.0) - SEVD-2020-343-04 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in the web server of the Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and their associated communication modules.
The Modicon Ethernet Programmable Automation are controllers for industrial process and infrastructure.
Failure to apply the remediations provided below may risk execution of commands on the webserver by an unauthenticated attacker, which could result in loss of availability and integrity on the controller.
August 2021 Update: Added remediation for the Modicon X80 BMXNOR0200H RTU Module

Overview

Schneider Electric

Modicon M340 CPUs

Schneider Electric Modicon M340 CPUs all versions prior to V3.30

Schneider Electric Modicon M340 Ethernet Communication modules BMXNOE0100 (H) versions prior to V3.3

Schneider Electric Modicon M340 Ethernet Communication modules BMXNOE0110 (H) versions prior to V6.5

Schneider Electric Modicon M340 Ethernet Communication modules BMXNOC0401 (H) versions prior to V2.10

Modicon Premium communication modules

Schneider Electric Modicon Premium communication modules TSXETY4103 versions prior to V6.2

Schneider Electric Modicon Premium communication modules TSXETY4103 prior to V6.4

Schneider Electric Modicon Premium processors with integrated Ethernet COPRO versions prior to V6.1

Schneider Electric Modicon Quantum processors with integrated Ethernet COPRO 140CPU65xx0 prior to V6.1

Modicon Quantum communication modules

Schneider Electric Modicon Quantum communication modules 140NOE771x1, prior to V7.1

Schneider Electric Modicon Quantum communication modules 140NOC78x00, prior to V1.74

Schneider Electric Modicon Quantum communication modules 140NOC77101, prior to V1.08

Modicon X80 BMXNOR0200H RTU module

<1.70 IR 23

Schneider Electric Modicon X80 BMXNOR0200H RTU module BMXNOR200H versions prior to V1.70 IR 233

Modicon M340 CPU

Schneider Electric Modicon M340 CPU 3.30

Schneider Electric Modicon M340 Ethernet Communication modules 3.3

Schneider Electric Modicon M340 Ethernet Communication modules 6.5

Schneider Electric Modicon M340 Ethernet Communication modules 2.10

Modicon Premium communication modules

Schneider Electric Modicon Premium communication modules 6.2

Schneider Electric Modicon Premium communication modules 6.4

Schneider Electric Modicon Premium processors with integrated Ethernet COPRO 6.1

Schneider Electric Modicon Quantum processors with integrated Ethernet COPRO 6.1

Modicon Quantum communication

Schneider Electric Modicon Quantum communication 7.1

Schneider Electric Modicon Quantum communication 1.74

Schneider Electric Modicon Quantum communication 1.08

Modicon X80 BMXNOR0200H RTU module

1.70 IR 23

Schneider Electric Modicon X80 BMXNOR0200H RTU module 1.70 IR 23

CVE-2020-7541

A CWE-425: Direct Request ('Forced Browsing') vulnerability exists that could cause disclosure of sensitive data when sending a specially crafted request to the controller over HTTP.

CVE Description

Firmware V3.30 is available for all of the product references. Follow this link and find the right firmware file based on model used:
https://www.se.com/ww/en/product-range/1468-modicon-m340/?parent-subcategory-id=3950

Firmware V3.3 is available for download below
https://www.se.com/ww/en/download/document/BMXNOE0100 Exec and Release Notes/

Firmware V6.5 is available for download below https://www.se.com/ww/en/download/document/BMXNOE0110 Exec and Release Notes/

Firmware V2.10 is available for download below https://www.se.com/ww/en/download/document/BMXNOC0401 Exec and Release Notes/

Firmware V6.2 is available for download below https://www.se.com/ww/en/download/document/TSXETY4103 Exec and Release Notes/

Firmware V6.4 is available for download below https://www.se.com/ww/en/download/document/TSXETY5103 Exec/

Firmware V6.1 is available for download below https://www.se.com/ww/en/download/document/TSXP574634M Premium Copro Exec and Release Notes/

Firmware V6.1 is available for download below https://www.se.com/ww/en/download/document/140CPU65260 Quantum Copro Exec and Release Notes/

Firmware V7.1 is available for download below https://www.se.com/ww/en/download/document/140NOE77101 Exec and Release Notes/

Firmware V1.74 is available for download below https://www.se.com/ww/en/download/document/140NOC78100 Exec and Release Notes/

Firmware V1.08 is available for download below https://www.se.com/ww/en/download/document/140NOC77101 Exec and Release Notes/

Firmware V1.70 IR 23 is available for download below https://www.se.com/ww/en/download/document/BMXNOR0200H_FW/

If customers choose not to apply the remediations provided in the remediation section, they should immediately apply the following mitigations to reduce the risk of exploit:
Modicon M340 CPU BMXP34* and Ethernet communication modules (BMXNOR0200H included)
• Configure the Access Control List following the recommendations of the user manual “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/
• Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control Expert using the following guideline: “Modicon M340 for Ethernet - Communication Modules and Processors, User Manual” in the chapter “Security / Security features”: https://www.se.com/ww/en/download/document/31007131K01000.
This is disabled by default when a new application is created

If customers choose not to apply the remediations provided in the remediation section, they should immediately apply the following mitigations to reduce the risk of exploit:
Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.
• Configure the Access Control List following the recommendations of the user manual “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP Services Configuration Parameters / Connection Configuration Parameters”:
https://www.se.com/ww/en/download/document/35006192K01000/ • Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control Expert using the following guideline “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” in the chapter “Security Service Configuration Parameters / Security (Enable / Disable HTTP, FTP, and TFTP)”.
https://www.se.com/ww/en/download/document/35006192K01000
This is disabled by default when a new application is created.

If customers choose not to apply the remediations provided in the remediation section, they should immediately apply the following mitigations to reduce the risk of exploit:
Schneider Electric’s Modicon Quantum controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.
• Configure the Access Control List feature as mentioned in “Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter “Software Settings for Ethernet Communication / Messaging / Quantum NOE Ethernet Messaging Configuration”: https://www.se.com/ww/en/download/document/33002467K01000/
• Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control Expert using the following guideline “ Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in the chapter “Security (Enable / Disable HTTP, FTP, and TFTP)”:
https://www.se.com/ww/en/download/document/33002479K01000
This is disabled by default when a new application is created.

CVE-2020-7541

CVE Description

Improper Check for Unusual or Exceptional Conditions


Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and associated Communication Modules

Summary: Original Release

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Overview

Schneider Electric

Modicon M340 CPUs

Schneider Electric Modicon M340 CPUs all versions prior to V3.30

Schneider Electric Modicon M340 Ethernet Communication modules BMXNOE0100 (H) all versions prior to V3.3

Schneider Electric Modicon M340 Ethernet Communication modules BMXNOE0110 (H) all versions prior to V6.5

Schneider Electric Modicon M340 Ethernet Communication modules BMXNOC0401 (H) all versions prior to V2.10

Modicon Premium communication modules

Schneider Electric Modicon Premium communication modules TSXETY4103 prior to V6.2

Schneider Electric Modicon Premium communication modules TSXETY4103 prior to V6.4

Schneider Electric Modicon Premium processors with integrated Ethernet COPRO versions prior to V6.1

Schneider Electric Modicon Quantum processors with integrated Ethernet COPRO 140CPU65xx0 prior to V6.1

Modicon Quantum communication modules

Schneider Electric Modicon Quantum communication modules 140NOE771x1, prior to V7.1

Schneider Electric Modicon Quantum communication modules 140NOC78x00, prior to V1.74

Schneider Electric Modicon Quantum communication modules 140NOC77101, prior to V1.08

Modicon X80 BMXNOR0200H RTU module

<1.70 IR 23

Schneider Electric Modicon X80 BMXNOR0200H RTU module BMXNOR0200H all versions prior to V1.70 IR 233

Modicon M340 CPU

Schneider Electric Modicon M340 CPU 3.30

Schneider Electric Modicon M340 Ethernet Communication modules 3.3

Schneider Electric Modicon M340 Ethernet Communication modules 6.5

Schneider Electric Modicon M340 Ethernet Communication modules 2.10

Modicon Premium communication modules

Schneider Electric Modicon Premium communication modules 6.2

Schneider Electric Modicon Premium communication modules 6.4

Schneider Electric Modicon Premium processors with integrated Ethernet COPRO 6.1

Schneider Electric Modicon Quantum processors with integrated Ethernet COPRO 6.1

Modicon Quantum communication

Schneider Electric Modicon Quantum communication 7.1

Schneider Electric Modicon Quantum communication 1.74

Schneider Electric Modicon Quantum communication 1.08

Modicon X80 BMXNOR0200H RTU module

1.70 IR 23

Schneider Electric Modicon X80 BMXNOR0200H RTU module 1.70 IR 23

CVE-2020-7540

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause unauthenticated command execution in the controller when sending special HTTP requests.

CVE Description

CyberSpace Non-Attack Research Institute of Elex Cybersecurity Inc


Summary: Original Release

Summary: Added all versions of BMXNOC0401 to the affected products table.

Summary: Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and Associated Communication Modules - SEVD-2020-343-05 PDF Version

Summary: Web Server on Modicon M340, Legacy Offers Modicon Quantum and Modicon Premium and Associated Communication Modules - SEVD-2020-343-05 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the web server of the Modicon M340, Modicon Quantum and Modicon Premium Legacy offers and associated communication modules. The Modicon Ethernet Programmable Automation controller products are controllers for industrial process and infrastructure.  Failure to apply the remediations provided below may risk an attack on the web server, which could result in disclosure of sensitive information.September 2022 Update: A remediation is available for Modicon M340 X80 Ethernet Communication Modules BMXNOC0401 (page 2).

Overview

Schneider Electric

Modicon M340 CPUs BMXP34*

Schneider Electric Modicon M340 CPUs BMXP34* versions prior to V3.30

Firmware V3.30

Schneider Electric Modicon M340 CPUs BMXP34*  Firmware V3.30

Schneider Electric Modicon M340 X80 Ethernet Communication modules BMXNOE0100 (H) prior to version 3.4

Firmware V3.4

Schneider Electric Modicon M340 X80 Ethernet Communication module BMXNOE0100 (H) Firmware V3.4

Schneider Electric Modicon M340 X80 Ethernet Communication modules BMXNOE0110 (H) prior to version 6.6

Firmware V6.6

Schneider Electric Modicon M340 X80 Ethernet Communication module BMXNOE0110 (H) Firmware V6.6

Schneider Electric Modicon M340 X80 Ethernet Communication modules BMXNOC0401 <V2.11

Schneider Electric Modicon M340 X80 Ethernet Communication module BMXNOC0401 V2.11

all versions

Schneider Electric Modicon Premium processors with integrated Ethernet COPRO TSXP574634 all versions

Schneider Electric Modicon Premium processors with integrated Ethernet COPRO TSXP575634 all versions

Schneider Electric Modicon Premium processors with integrated Ethernet COPRO TSXP576634 all versions

Schneider Electric Modicon Quantum processors with integrated Ethernet COPRO 140CPU65xxxxx all versions

Schneider Electric Modicon Quantum communication modules 140NOE771x1 versions prior to V7.3

Firmware V7.3

Schneider Electric Modicon Quantum communication modules 140NOE771x1 Firmware V7.3

all versions

Schneider Electric Modicon Quantum communication modules 140NOC78x00 all versions

Schneider Electric Modicon Quantum communication modules 140NOC77101 all versions

Schneider Electric Modicon Premium communication modules TSXETY4103 all versions

Schneider Electric Modicon Premium communication modules TSXETY5103 all versions

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Firmware V3.30 is available for all the product references. Follow this link and find the right firmware file based on model used. https://www.se.com/ww/en/product-range/1468-modicon-m340/?parent-subcategory-id=3950

Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control Expert using the following guideline: “Modicon M340 for Ethernet - Communication Modules and Processors, User Manual” in the chapter “Security / Security features”: https://www.se.com/ww/en/download/document/31007131K01000.

Firmware V3.4 is available for download belowFirmware V3.4 is available for download belowhttps://www.se.com/ww/en/download/document/BMXNOE0100 Exec and Release Notes/

Firmware V6.6 is available for download belowhttps://www.se.com/ww/en/download/document/BMXNOE0110 Exec and Release Notes/

BMXNOC0401 V2.11 is available for download that has a fix of the reported vulnerabilities: https://www.se.com/ww/en/product/BMXNOC0401/ethernet-tcp-ip-network-module-modicon-m340-automation-platform-4-x-rj45-10-100/

Firmware V7.3 is available for download belowhttps://www.se.com/ww/en/download/document/140NOE77101 Exec and Release Notes/

Modicon Quantum and associated communication modules:Schneider Electric’s Modicon Quantum controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.To mitigate the risks, users should immediately:•Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control Expert using the following guideline “ Quantum using EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in the chapter “Security (Enable / Disable HTTP, FTP, and TFTP)”:https://www.se.com/ww/en/download/document/33002479K01000

Modicon Premium and associated communication Modules: Schneider Electric’s Modicon Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer. Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.To mitigate the risks, users should immediately:•Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control Expert using the following guideline “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” in the chapter “Security Service Configuration Parameters / Security (Enable / Disable HTTP, FTP, and TFTP)”: https://www.se.com/ww/en/download/document/35006192K01000
For further information, please check the “Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network Modules, User Manual” and the Modicon Controllers Platform Cyber Security Reference Manual

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal' Vulnerability Type)vulnerability exists that could cause disclosure of information when sending a specially crafted request to the controller over HTTP.


Web Server on Modicon M340, Legacy Offers Modicon Quantum Modicon Premium and associated Communication Modules

Summary: Original Release

Summary: Web Server on Modicon M340, Legacy Offers Modicon Quantum - SEVD-2020-343-06_v2 PDF Version

Summary: Web Server on Modicon M340, Legacy Offers Modicon Quantum - SEVD-2020-343-06_v2 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon M340, Modicon Quantum and
Modicon Premium legacy offers and associated communication modules.
The Modicon Ethernet Programmable Automation controller products are controllers for
industrial process and infrastructure.
Failure to apply the remediations provided below may risk a Denial-of-Service attack, which
could result in the unavailability of the web and FTP services.
September 2022 update: A fix is available for Modicon M340 X80 Ethernet Communication Module BMXNOC0401

Overview

Schneider Electric

Modicon M340 CPUs

Schneider Electric Modicon M340 CPUs versions prior to 3.30

Schneider Electric Modicon M340 CPUs 3.30

Schneider Electric Modicon M340 Ethernet Communication Modules versions prior to 3.4

Schneider Electric Modicon M340 Ethernet Communication Modules 3.4

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOE0110 versions prior to 6.6

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOE0110  6.6

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOC0401 (H) versions prior to 2.11

Schneider Electric Modicon M340 Ethernet Communication Modules BMXNOC0401 (H) 2.11

Schneider Electric Modicon Quantum Communication Modules 140NOE771x1 versions prior to 7.3

Schneider Electric Modicon Quantum Communication Modules 140NOE771x1 7.3

Modicon Quantum Communication Modules

Schneider Electric Modicon Quantum Communication Modules All versions

Schneider Electric Modicon Quantum Processors with Integrated Ethernet COPRO 140CPU65xx0 All versions

Modicon Premium Communication Modules

Schneider Electric Modicon Premium Communication Modules All versions

Schneider Electric Modicon Premium Processors with Integrated Ethernet COPRO All versions

CVE-2020-7549

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that
could cause denial of HTTP and FTP services when a series of specially crafted requests is
sent to the controller over HTTP.

CVE Description

Firmware V3.30 is available for all the product references.
Follow this link and find the right firmware file based on model
used:
https://www.se.com/ww/en/product-range/1468-modiconm340/?parent-subcategory-id=3950
If customers choose not to apply the remediation, see Mitigation section.

Firmware V3.4 is available for download below:
https://www.se.com/ww/en/download/document/BMXNOE010
0 Exec and Release Notes/
If customers choose not to apply the remediation, see Mitigation
section below

Firmware V6.6 is available for download below:
https://www.se.com/ww/en/download/document/BMXNOE011
0 Exec and Release Notes/
If customers choose not to apply the remediation, see Mitigation
section below

Firmware V2.11 is available for download below:
https://www.se.com/ww/en/product/BMXNOC0401/ethernettcp-ip-network-module-modicon-m340-automation-platform-4-x-rj45-10-100/
If customers choose not to apply the remediation, see Mitigation
section below.

Firmware V7.3 is available for download below:
https://www.se.com/ww/en/download/document/140NOE7710
1 Exec and Release Notes/
If customers choose not to apply the remediation, see Mitigation
section below.

Modicon Quantum and associated communication Modules:
Schneider Electric’s Modicon Quantum controllers have reached
their end of life and are no longer commercially available. They have
been replaced by the Modicon M580 ePAC controller, our most
current product offer. Customers should strongly consider migrating
to the Modicon M580 ePAC. Please contact your local Schneider
Electric technical support for more information.
To mitigate the risks, users should immediately:
• Disable the Web server using 'Web Access (HTTP)' via
UnityPro / EcoStruxure Control Expert using the following
guideline “ Quantum using EcoStruxure™ Control Expert -
TCP/IP Configuration, User Manual” in the chapter “Security
(Enable / Disable HTTP, FTP, and TFTP)”:
https://www.se.com/ww/en/download/document/33002479K
01000
For further information, please check the “Quantum using
EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual”
and the Modicon Controllers Platform Cyber Security Reference
Manual.

Modicon Premium and associated communication Modules:
Schneider Electric’s Modicon Premium controllers have reached
their end of life and are no longer commercially available. They have
been replaced by the Modicon M580 ePAC controller, our most
current product offer. Customers should strongly consider migrating
to the Modicon M580 ePAC. Please contact your local Schneider
Electric technical support for more information

Disable the Web server using 'Web Access (HTTP)' via
UnityPro / EcoStruxure Control Expert using the following
guideline “Premium and Atrium using EcoStruxure™ Control
Expert - Ethernet Network Modules, User Manual” in the
chapter “Security Service Configuration Parameters /
Security (Enable / Disable HTTP, FTP, and TFTP)”:
https://www.se.com/ww/en/download/document/35006192K
01000
For further information, please check the “Premium and Atrium using
EcoStruxure™ Control Expert - Ethernet Network Modules, User
Manual” and the Modicon Controllers Platform Cyber Security
Reference Manual https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO00
00001999.07.pdf&p_Doc_Ref=EIO0000001999

To mitigate the risks, users should immediately:
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/
• Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control
Expert using the following guideline: “Modicon M340 for Ethernet - Communication
Modules and Processors, User Manual” in the chapter “Security / Security features”:
https://www.se.com/ww/en/download/document/31007131K01000.
This is disabled by default when a new application is created

Disable the Web server using 'Web Access (HTTP)' via UnityPro / EcoStruxure Control Expert
using the following guideline “ Quantum using EcoStruxure™ Control Expert - TCP/IP
Configuration, User Manual” in the chapter “Security (Enable / Disable HTTP, FTP, and TFTP)”:
https://www.se.com/ww/en/download/document/33002479K01000
For further information, please check the “Quantum using EcoStruxure™ Control Expert -
TCP/IP Configuration, User Manual” and the Modicon Controllers Platform Cyber Security
Reference Manual


Summary: Original Release

Summary:
BMXNOC0401 added as an affected product
Remediation section now includes BMXNOR0200H

Summary: SNMP Service on Modicon M340 and Associated Communication Modules - SEVD-2020-343-07 PDF Version

Summary: SNMP Service on Modicon M340 and Associated Communication Modules - SEVD-2020-343-07 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in the Modicon M340 offer and associated communication modules.
Modicon M340 Programable Automation Controllers are used in industrial processes and infrastructure control.
Failure to apply the remediations provided below may risk unexpected modification of network parameters, which could result in making targeted devices unreachable.
September 2022 update: A remediation is available for Modicon M340 X80 Ethernet Communication module BMXNOC0401.

Overview

Schneider Electric

Modicon M340 CPUs BMXP34*

Schneider Electric Modicon M340 CPUs BMXP34* versions prior to 3.30

Schneider Electric Modicon M340 CPUs BMXP34* 3.30

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOE0100 (H) versions prior to 3.4

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOE0100 (H) 3.4

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOE0110 (H) versions prior to 6.6

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOE0110 (H) 6.6

<1.7 IR22

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOR0200H versions prior to 1.7 IR22

1.7 IR22

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOR0200H 1.7 IR22

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOC0401 versions prior to 2.11

Schneider Electric Modicon M340 X80 Communication Ethernet modules BMXNOC0401 2.11

CVE-2020-7536

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause the device to be unreachable when doing an unattended modification of network parameters over SNMP.

CVE Description

Firmware V3.4 is available for download below: https://www.se.com/ww/en/download/document/BMXNOE010 Exec and Release Notes/

Firmware V6.6 is available for download below: https://www.se.com/ww/en/download/document/BMXNOE0110 Exec and Release Notes/

Firmware V3.30 is available for all the product references. Follow this link and find the right firmware file based on model used:
https://www.se.com/ww/en/product-range/1468-modicon-m340/?parent-subcategory-id=3950

Firmware V1.7 IR22 is available for download below: https://www.se.com/ww/en/download/document/BMXNOR0200H_FW/

Firmware V2.11 is available for download below: https://www.se.com/ww/en/product/BMXNOC0401/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 161/UDP 162/UDP.


Summary: Original Release

Summary: Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium - SEVD-2020-343-08 PDF Version

Summary: Modicon M580, Modicon M340, Legacy Controllers Modicon Quantum & Modicon Premium - SEVD-2020-343-08 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Modicon programmable automation
controllers.
The Modicon Ethernet Programmable Automation products are controllers for industrial process
and infrastructure.
Failure to apply the remediations provided below may risk a denial of service attack, which
could result in making the device enter a non-recoverable fault state.

Overview

Customers should use appropriate methodologies when upgrading their systems. We strongly recommend the use of back-ups and evaluating the impact of these upgrades in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance removing a patch.

Overview

Schneider Electric

Modicon M580 CPUs - BMEx58xxxxx

Schneider Electric Modicon M580 CPUs - BMEx58xxxxx prior to version 3.20

Modicon M340 CPUs - BMX P34x

Schneider Electric Modicon M340 CPUs - BMX P34x prior to version 3.30

Schneider Electric Modicon Premium CPUs - TSXP574634, TSXP575634, TSXP576634 all versions

Modicon Quantum CPUs - 140CPU65xxxxx

Schneider Electric Modicon Quantum CPUs - 140CPU65xxxxx all versions

Modicon M580 CPUs - BMEx58xxxxx

Schneider Electric Modicon M580 CPUs - BMEx58xxxxx 3.20

Modicon M340 CPUs - BMX P34x

Schneider Electric Modicon M340 CPUs - BMX P34x 3.30

CVE-2020-7537

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that
could cause denial of service when a specially crafted Read Physical Memory request over
Modbus is sent to the controller.

CVE Description

These vulnerabilities are fixed in firmware version 3.20,
available for all product references. Follow this link to
find the right firmware file based on model used:
https://www.se.com/ww/en/product-range/62098-
modicon-m580/
If customers choose not to apply the remediation provided
above, they should immediately apply the Modicon M580
Mitigations provided below to reduce the risk of exploit.

These vulnerabilities are fixed in firmware version 3.30,
available for all product references. Follow this link to
find the right firmware file based on model used:
https://www.se.com/ww/en/product-range/1468-
modicon-m340/
If customers choose not to apply the remediation provided
above, they should immediately apply the Modicon M340
Mitigations provided below to reduce the risk of exploit.

To mitigate the risks associated to Modbus weaknesses, users should immediately:
• Setup network segmentation and implement a firewall to block all unauthorized
access to port 502/TCP
Setup a secure communication according to the following guideline “Modicon
Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Use a BMENOC module and follow the instructions to configure IPSEC feature as
described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications
Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC
communications”: https://www.se.com/ww/en/download/document/HRB62665/

To mitigate the risks associated to Modbus weaknesses, users should immediately:
• Setup network segmentation and implement a firewall to block all unauthorized
access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual
“Modicon M340 for Ethernet Communications Modules and Processors User
Manual” in chapter “Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/

Schneider Electric's Modicon Premium controllers have reached their end of life and are no
longer commercially available. They have been replaced by the Modicon M580 ePAC
controller, our most current product offer. Customers should strongly consider migrating to the
Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more
information.
To mitigate the risks associated to Modbus/ weaknesses, users should immediately:
• Setup network segmentation and implement a firewall to block all unauthorized
access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual
“Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network
Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP
Services Configuration Parameters / Connection Configuration Parameters”:
https://www.se.com/ww/en/download/document/35006192K01000/

CVE-2020-7542

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that
could cause denial of service of the controller when a specially crafted Read request over
Modbus is send to the controller.

CVE Description

INCIBE - Spanish National Institute of Cybersecurity

Schneider Electric's Modicon Quantum controllers have reached their end of life and are no
longer commercially available. They have been replaced by the Modicon M580 ePAC controller,
our most current product offer. Customers should strongly consider migrating to the Modicon
M580 ePAC. Please contact your local Schneider Electric technical support for more
information.
To mitigate the risks associated to Modbus/ weaknesses, users should immediately:
• Setup network segmentation and implement a firewall to block all unauthorized
access to port 502/TCP
• Configure the Access Control List feature as mentioned in “Quantum using
EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter
“Software Settings for Ethernet Communication / Messaging / Quantum NOE
Ethernet Messaging Configuration”:
https://www.se.com/ww/en/download/document/33002467K01000/

CVE-2020-7543

CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that
could cause a denial of service of the controller when a malformed Routing request over
Modbus is send to the controller.

CVE Description


Summary: Original Release

Summary: Modicon M258 Logic Controllers and SoMachine/ SoMachine Motion Software - SEVD-2020-343-09 PDF Version

Summary: Modicon M258 Logic Controllers and SoMachine/ SoMachine Motion Software - SEVD-2020-343-09 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its M258 Logic Controllers and SoMachine/
SoMachine Motion software.
The M258 Logic Controllers and SoMachine/SoMachine Motion software are Programmable
Logic Controllers and the associated programming software.
Failure to apply the remediations provided below may risk buffer overflow attack, which could
result in arbitrary code execution or unavailability of the process or operations.

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance removing a patch. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric's security notification service here: https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

Overview

Schneider Electric

Modicon M258 Firmware

Schneider Electric Modicon M258 Firmware All versions prior to V5.0.4.11

SoMachine/SoMachine Motion software

Schneider Electric SoMachine/SoMachine Motion software All versions

Modicon M258 Logic Controller

Schneider Electric Modicon M258 Logic Controller Version 5.0.4.11

Latest Version

Schneider Electric SoMachine/SoMachine Motion (now called EcoStruxure Machine Expert) New Version

CVE-2020-28220

CWE-119: Improper Restriction of Operations within the Bounds of a Memory
Buffer vulnerability exists that could cause a buffer overflow when the length of a file transferred
to the webserver is not verified.

CVE Description

Version 5.0.4.11 of the Modicon M258 Logic Controller and the new software version of
SoMachine/SoMachine Motion (now called EcoStruxure Machine Expert) no longer exhibit this
problem.
We recommend customers migrate from the legacy SoMachine/SoMachine Motion software to
the new version called EcoStruxure Machine Expert (available here
https://www.se.com/ww/en/product-range-download/2226-ecostruxure-machine-expert/ -
/software-firmware-tab). Then, update the Modicon M258 Logic Controller firmware to the latestversion through Schneider Electric Software Update (SESU). Note: a reboot of the controller is
required.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Configure access control lists to restrict web server and FTP access to authorized IP
addresses;
• Protect access to Modicon products with network, industrial, and application firewalls.
• Disable web server if not needed.
• Disable FTP server if not needed. This is disabled by default.


Summary: Original Release

Summary: Treck HTTP Server Vulnerability on TM3 Bus Coupler Modules (V2.0) - SEVD-2020-353-02 PDF Version

Summary: Treck HTTP Server Vulnerability on TM3 Bus Coupler Modules (V2.0) - SEVD-2020-353-02 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability affecting Treck Inc.’s HTTP Server component used in the Schneider Electric TM3BC bus coupler modules.
Failure to apply the mitigations provided below may risk heap-based buffer overflow, which could result in Denial of Service of the webserver.
August 2021 Update: Added remediation for all TM3 Bus Coupler products.

Overview

Schneider Electric

TM3 Bus Coupler

Schneider Electric TM3 Bus Coupler firmware version 2.1.50.2 and prior

Schneider Electric TM3 Bus Coupler firmware version 2.0.50.2 and prior

Schneider Electric TM3 Bus Coupler <=2.0.50.2

Schneider Electric TM3 Bus Coupler 2.2.1.1

Schneider Electric TM3 Bus Coupler 2.1.1.1

CVE-2020-25066

A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possibly execute arbitrary code.

CVE Description

A fix is now available in firmware version V2.2.1.1 which can be downloaded below: https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 which can be downloaded below: https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 which can be downloaded below: https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
• Restrict physical access to the USB RNDIS port of the Bus Coupler
• Prevent permanent connection between the engineering workstation and the USB RNDIS port of the Bus Coupler, so that no unauthorized personnel or device can access your product.
• Minimize network exposure, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet.
• Implement a firewall to block all unauthorized access to ports 80/TCP and 443/TCP.
• If network access is not required: Remove the Ethernet cable from the affected device.


EcoStruxure Power Build - Rapsody

Summary: Original Release

Summary: Final Remediations Added

Summary: EcoStruxure Power Build - Rapsody - SEVD-2021-012-02 CSAF Version

Summary: EcoStruxure Power Build - Rapsody - SEVD-2021-012-02 PDF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Power Build - Rapsody product.
The EcoStruxure Power Build - Rapsody product is a LV switchboard configuration and quotation software to support users in the configuration and quotation process for Prisma switchboard projects in the non-critical building segment.
Failure to apply the mitigations provided below may allow remote code execution which could result in serious interruption of business operations and exfiltration of credentials and other business sensitive data.
June 2022 Update: Remediation added

Overview

Schneider Electric EcoStruxure Power Build: Rapsody Software <V2.1.13

Schneider Electric EcoStruxure Power Build: Rapsody Software V2.1.13

CVE-2021-22697

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could allow a use-after-free condition which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.

CVE Description

 These vulnerabilities have been fixed in V2.1.13. Links to the fix versions in supported languages can be found below:
https://www.se.com/us/en/faqs/FA379051/

Customers should use appropriate patching methodologies when applying these patches to their systems.
We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure.
Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
Apply the principle of least privilege to limit access to the computer running the Rapsodysoftware to only those personnel that require access to it.
Install application allow list software on the computer to block the execution of maliciouscode.
Install anti-virus on the computer and keep it up to date.

CVE-2021-22698

A CWE-434: Unrestricted Upload of File with Dangerous Type vulnerability exists that could allow a stack-based buffer overflow to occur which could result in remote code execution when a malicious SSD file is uploaded and improperly parsed.

CVE Description


PowerLogic Power Metering Products

Summary: Original Release

Summary: PowerLogic Power Metering Products - SEVD-2021-040-01 PDF Version

Summary: PowerLogic Power Metering Products - SEVD-2021-040-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its PowerLogic ION7400, ION7650,
ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM8000 products.
The PowerLogic metering products are revenue and power quality meters for utility and
industrial electrical network monitoring.
Failure to apply the mitigations/remediations provided below may risk disclosure of user
credentials when using HTTP or Telnet protocol or cause a user to perform an unintended
action on a target device when using HTTP, which could result in unintended device behavior.

Overview

Customers should use appropriate methodologies when applying these upgrades to their devices. We strongly recommend evaluating the impact of these updates in a test and development environment prior to deployment. Contact Schneider Electric's Customer Care Center if you need assistance reverting to an older version of firmware.

Overview

Schneider Electric

Schneider Electric ION7400 All versions prior to V3.0.0

Schneider Electric ION7700/73xx All versions. Note: Only affected by CVE-2021-22702 as these products do not support HTTP web functionality.

Schneider Electric ION83xx/84xx/85xx/8600 All versions

Schneider Electric ION8650 V 4.31.2 and prior

Schneider Electric ION9000 All versions prior to V3.0.0

Schneider Electric PM8000 All versions prior to V3.0.0

PowerLogic ION7400

Schneider Electric PowerLogic ION7400 V3.0.0

PowerLogic ION8650

Schneider Electric PowerLogic ION8650 V4.40.1

PowerLogic ION9000

Schneider Electric PowerLogic ION9000 V3.0.0

PowerLogic PM8000

Schneider Electric PowerLogic PM8000 V3.0.0

Schneider Electric ION7400 v2.1.0 to V2.2.1

Schneider Electric PM8000 V2.1.0 to V2.2.1

Schneider Electric ION7400 prior to V2.1.0

Schneider Electric PM8000 prior to V2.1.0

Schneider Electric ION8650 V4.20.1 to 4.31.2

Schneider Electric ION7650 V415 or later

>= 362

Schneider Electric ION8800 V362 or later

Schneider Electric ION8650 prior to V4.20.1

Schneider Electric ION7650 prior to V415

Schneider Electric ION8800 prior to V362

CVE-2021-22701

CWE-352: Cross-Site Request Forgery vulnerability exists that could cause a user to perform
an unintended action on the target device when using the HTTP web interface.

CVE Description

V3.0.0 of the PowerLogic ION7400 firmware includes fixes
for these vulnerabilities by replacing Telnet functionality
with SSH. Additionally, HTTP web interface was removed
(only HTTPS mode now supported). The version update
files are available for download here:
https://www.se.com/ww/en/download/document/ION7400_
meter_FW_v003.000.000/
Note: There may be newer versions of the firmware
available for download, please check the ION7400 https://www.se.com/us/en/product-range-download/63502-powerlogic-ion7400-series/#/software-firmware-tab product
page on se.com before upgrading.
Customers who do not wish to apply this remediation
should refer to the mitigations below.

V4.40.1 of the PowerLogic ION8650 firmware includes fixes
for these vulnerabilities by replacing Telnet functionality
with SSH and making web pages read only. The version
update files are available for download here:
https://www.se.com/ww/en/download/document/ION8650_
meter_FW_V004.040.001/
Note: There may be newer versions of the firmware
available for download, please check the ION8650 https://www.se.com/us/en/product-range-download/61053-powerlogic-ion8650-series/?selected-node-id=12144491661#/software-firmware-tab product
page on se.com before upgrading.
Customers who do not wish to apply this remediation
should refer to the mitigations below.

V3.0.0 of the PowerLogic ION9000 firmware includes fixes
for these vulnerabilities by replacing telnet functionality with
SSH. Additionally, HTTP web interface was removed (only
HTTPS mode now supported). The version update files are
available for download here:
https://www.se.com/ww/en/download/document/ION9000_
meter_FW_v003.000.000/
Note: There may be newer versions of the firmware
available for download, please check the ION9000 https://www.se.com/us/en/product-range-download/64241-powerlogic-ion9000-series/#/software-firmware-tab product
page on se.com before upgrading.
Customers who do not wish to apply this remediation
should refer to the mitigations below.

V3.0.0 of the PowerLogic PM8000 firmware includes fixes
for these vulnerabilities by replacing telnet functionality with
SSH. Additionally, HTTP web interface was removed (only
HTTPS mode now supported). The version update files are
available for download here:
https://www.se.com/ww/en/download/document/PM8000_m
eter_FW_v003.000.000/
Note: There may be newer versions of the firmware
available for download, please check the ION8000 https://www.se.com/us/en/product-range-download/62252-powerlogic-pm8000-series/#/software-firmware-tab product
page on se.com before upgrading.
Customers who do not wish to apply this remediation
should refer to the mitigations below.

A remediation does not exist for these products, please
refer to the Mitigations section below for information on how
to reduce the risk of exploit.

Customers should immediately apply the following mitigations
to reduce the risk of exploit:
• Disable Telnet functionality
• To mitigate plain text HTTP, ensure HTTPS is enabled
• To mitigate Cross-Site request forgery, disable HTTP
and HTTPS web functionality

Customers should immediately apply the following mitigations
to reduce the risk of exploit:
• Disable Telnet functionality
• Disable HTTP functionality

Customers should immediately apply the following mitigations
to reduce the risk of exploit:
• Disable Telnet functionality
• Disable HTTP web functionality

Customers should immediately apply the following mitigations
to reduce the risk of exploit:
• Disable HTTP web functionality
A mitigation does not exist for Telnet access. Please upgrade
to a newer firmware version and apply the appropriate
mitigation.

These products are no longer within a support period.
Customers should immediately apply the following mitigations
to reduce the risk of exploit:
• Disable HTTP web functionality
A mitigation does not exist for Telnet access. Customers
should also consider upgrading to the latest product offering
PowerLogic ION8650 https://www.se.com/ww/en/product-range/61053-powerlogic-ion8650/  to resolve these vulnerabilities.

CVE-2021-22702

CWE-319: Cleartext transmission of sensitive information vulnerability exists that could
cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic
between a user and the device.

CVE Description

Cleartext Transmission of Sensitive Information

These products are no longer within a support period.
A mitigation does not exist for Telnet access. Customers
should consider upgrading to the latest product offering
PowerLogic ION9000 https://www.se.com/ww/en/product-range/64241-powerlogic%E2%84%A2-ion9000/ , PowerLogic PM8000 https://www.se.com/ww/en/product-range/62252-powerlogic-pm8000-series/ , or PowerLogic
ION7400 https://www.se.com/ww/en/product-range/63502-powerlogic-ion7400/  to resolve these vulnerabilities.

CVE-2021-22703

CWE-319: Cleartext transmission of sensitive information vulnerability exists that could
cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic
between a user and the device.

CVE Description


Summary: Original Release

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2021-068-01 PDF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2021-068-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Interactive Graphical SCADA
System (IGSS) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling
industrial processes. IGSS communicates with all major industry standard PLC drivers.
Failure to apply the remediations provided below may risk remote code execution, which could
result in an attacker gaining access to the Windows Operating System on the machine used to
import CGF files, typically a step performed during system design time.

Overview

Schneider Electric

IGSS Definition (Def.exe)

Schneider Electric IGSS Definition (Def.exe) version 15.0.0.21041 and prior

Schneider Electric IGSS Definition (Def.exe) Version 15.0.0.21042

CVE-2021-22709

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could result in loss of data or remote code execution when malicious
CGF (Configuration Group File) file is imported to IGSS Definition.

CVE Description

Version 15.0.0.21042 of the IGSS Definition module: Def.exe includes a fix for each of these
vulnerabilities and is available for download through IGSS Master > Update IGSS Software or
here:
Customers should use appropriate patching methodologies when applying these patches to
their systems. We strongly recommend the use of back-ups and evaluating the impact of these
patches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric's Customer Care Center if you need assistance removing a patch.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Avoid importing CGF files from untrusted sources.

CVE-2021-22710

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could cause remote code execution when malicious CGF (Configuration
Group File) file is imported to IGSS Definition.

CVE Description

CVE-2021-22711

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could result in arbitrary read or write conditions when malicious CGF
(Configuration Group File) file is imported to IGSS Definition due to missing validation of input
data.

CVE Description

CVE-2021-22712

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could result in arbitrary read or write conditions when malicious CGF
(Configuration Group File) file is imported to IGSS Definition due to an unchecked pointer
address.

CVE Description


Summary: Original Release

Summary: PowerLogic ION7400 / PM8000 / ION9000 Power Meters - SEVD-2021-068-02 PDF Version

Summary: PowerLogic ION7400 / PM8000 / ION9000 Power Meters - SEVD-2021-068-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its PowerLogic ION7400, PM8000 and ION9000
products.
The PowerLogic metering products are revenue and power quality meters for utility and
industrial electrical network monitoring.
Failure to apply the mitigations/remediations provided below may risk meter reboot or remote
code execution, which could result in unintended device behavior.

Overview

Customers should use appropriate methodologies when applying these upgrades to their devices. We strongly recommend evaluating the impact of these updates in a test and development environment prior to deployment. Contact Schneider Electric's Customer Care Center if you need assistance reverting to an older version of firmware. For alternative mitigations, customers should follow the General Security Recommendations provided below to reduce the risk of exploit.

Overview

Schneider Electric

Schneider Electric ION7400 All versions prior to V3.0.0

Schneider Electric ION9000 All versions prior to V3.0.0

Schneider Electric PM8000 All versions prior to V3.0.0

PowerLogic ION7400

Schneider Electric PowerLogic ION7400 V3.0.0

PowerLogic PM8000

Schneider Electric PowerLogic PM8000 V3.0.0

CVE-2021-22714

CWE-119: Improper restriction of operations within the bounds of a memory buffer
vulnerability exists that could cause the meter to reboot or allow for remote code execution.

CVE Description

V3.0.0 (released 30 July 2020) of the PowerLogic ION7400 firmware
includes a fix for this vulnerability. The version update files are available
for download here: https://www.se.com/ww/en/download/document/ION7400_meter_FW_v003.000.000/ . Note: There may be newer versions of the firmware available for download, please check the ION7400: https://www.se.com/us/en/product-range-download/63502-powerlogic-ion7400-series/#/software-firmware-tab product page on before upgrading.

V3.0.0 (released 30 July 2020) of the ION9000 firmware includes a fix
for this vulnerability. The version update files are available for download
here: available for download here: https://www.se.com/ww/en/download/document/ION9000_meter_FW_v003.000.000/ . There may be newer versions of the firmware available for download, please check the ION9000: https://www.se.com/us/en/product-range-download/64241-powerlogic-ion9000-series/#/software-firmware-tab product page before upgrading.

V3.0.0 (released 30 July 2020) of the PowerLogic PM8000 firmware
includes a fix for this vulnerability. The version update files are available
for download here: https://www.se.com/ww/en/download/document/PM8000_meter_FW_v003.000.000/ . There may be newer versions of the firmware available for download, please check the ION8000:https://www.se.com/us/en/product-range-download/62252-powerlogic-pm8000-series/#/software-firmware-tab product page before upgrading.


C-Bus Toolkit and C-Gate Server

Summary: Original Release

Summary: Added CVE-2021-22748

Summary:
• C-Gate Server added as an affected product of CVE-2021-22720
• CVE-2021-22796 added
• Updated the previously provided remediation
• Added Tenable Security to the acknowledgement section

Summary: C-Bus Toolkit and C-Gate Server - SEVD-2021-103-01 PDF Version

Summary: C-Bus Toolkit and C-Gate Server - SEVD-2021-103-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its C-Bus Toolkit and C-Gate server products.
The C-Bus Toolkit product, which includes C-Gate Server, is an application you run on your personal computer to configure and commission C-Bus Installations.
Failure to apply the remediations provided below may risk remote code execution attack, which could result in an attacker having remote access to the computer.
November 2022 Update: The CWE for CVE-2021-22716 has been updated (marked in red). No additional action is required for customers who have already followed the remediation instructions provided below.

Overview

Schneider Electric

C-Bus Toolkit

Schneider Electric C-Bus Toolkit <1.15.9

C-Gate Server

Schneider Electric C-Gate Server <2.11.7

C-Bus Toolkit

Schneider Electric C-Bus Toolkit 1.15.10

CVE-2021-22716

A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could allow remote code execution when an unprivileged user modifies a file.

CVE Description

Version 1.15.10 of the C-Bus Toolkit product, which contains the C-Gate Server, includes a fix for these vulnerabilities and is available for download here:

Version 2.11.8 of the C-Gate Server product is also available at the link below.

CVE-2021-22717

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when processing config files.

CVE Description

CVE-2021-22718

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when restoring project files.

CVE Description

CVE-2021-22719

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a file is uploaded.

CVE Description

CVE-2021-22720

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when restoring a project.

CVE Description

CVE-2021-22748

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow a remote code execution when a file is saved.

CVE Description

CVE-2021-22796

A CWE-287:Improper Authentication vulnerability exists that could allow remote code execution when a malicious file is uploaded.

CVE Description


Modicon Managed Switch

Summary: Original Release

Summary: Modicon Managed Switch - SEVD-2021-130-01 PDF Version

Summary: Modicon Managed Switch - SEVD-2021-130-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon Managed Switch products.
The Modicon Managed Switch products are designed for the special requirements of industrial
automation. The devices allow users to set up switched Industrial Ethernet networks.
Failure to apply the firmware upgrade or mitigations provided below may allow an attacker to
change the password of any user, which could cause all or part of the switch to be controlled by
the attacker. That could result in various attack types like denial of service or provide access to
unauthorized devices on the network.

Overview

Schneider Electric

Schneider Electric Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior

Modicon Managed Switch

Schneider Electric Modicon Managed Switch Version 8.22

CVE-2021-22731

CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability
exists that could cause an unauthorized password change through HTTP / HTTPS when basic
user information is known by a remote attacker.

CVE Description

Version 8.22 of the Modicon Managed Switch products includes a fix for this vulnerability and is
available for download here: The upgrade procedure is detailed in the MCSESM, MCSESM-E Managed Switch User Manual
Configuration available below, is also applicable for MCSESP references. It is important to note
that the upgrade procedure must be applied twice with the same version to prevent rollback.
User Manual Configuration: https://download.schneiderelectric.com/files?p_Doc_Ref=QGH59056
Customers should use appropriate patching methodologies when applying these patches to their
systems. We strongly recommend the use of back-ups and evaluating the impact of these patches
in a Test and Development environment or on an offline infrastructure. Contact Schneider
Electric's Customer Care Center if you need assistance removing a patch.

If customers choose not to apply the remediation provided above, they should immediately apply
the following mitigations to reduce the risk of exploit:
• Set non-guessable usernames
• Configure IP address access restrictions
• Deactivate device access through HTTP / HTTPS.


homeLYnk (Wiser For KNX) and spaceLYnk

Summary: Original Release

Summary: The CWE for CVE-2021-22737 has been updated(marked in red). No additional action is required for customers who have already followed the remediation instructions provided.

Summary: homeLYnk (Wiser For KNX) and spaceLYnk - SEVD-2021-130-04 PDF Version

Summary: homeLYnk (Wiser For KNX) and spaceLYnk - SEVD-2021-130-04 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its homeLYnk (Wiser For KNX) and
spaceLYnk products.
HomeLYnk (Wiser for KNX) products are personalized energy efficiency solutions, offering a
complete system based on open protocols: KNX, Modbus, BACnet and IP.
spaceLYnk connects building control functions, thus achieving a complete building management
solution for small and medium as well as large buildings.
Failure to apply the remediations and mitigations provided below may risk a variety of attacks,
which could result in remote access to the product.

Overview

Schneider Electric

homeLYnk (Wiser For KNX)

Schneider Electric homeLYnk (Wiser For KNX) versions 2.60 and prior

spaceLYnk

Schneider Electric spaceLYnk versions 2.60 and prior

homeLYnk (Wiser For KNX)

Schneider Electric homeLYnk (Wiser For KNX) 2.61

CVE-2021-22732

A CWE-269: Improper Privilege Management vulnerability exists that could cause a code
execution issue when an attacker loads unauthorized code on the web server.

CVE Description

Version 2.61 of homeLYnk (Wiser For KNX) and spaceLYnk include a fix
for these vulnerabilities and are available for download below:
homeLYnk (Wiser For KNX) V2.61 -
https://www.se.com/ww/en/product/LSS100100/wiser-for-knx-logiccontroller/#pdp-software
spaceLYnk V2.61 -
https://www.se.com/ww/en/product/LSS100200/spacelynk-logiccontroller/#pdp-software
Note: Reboot is needed after installation. Please check the version
number in the configuration to confirm the update.

Due to hardware limitations, these CVEs will not be fixed and customers
should immediately apply the recommendations provided in the System
Hardening Guide to reduce the risk of exploit.
System Hardening Guide for homeLYnk (Wiser For KNX) :
https://download.schneider-electric.com/files?p_Doc_Ref=AN002_107
System Hardening Guide for spaceLYnk:
https://download.schneider-electric.com/files?p_Doc_Ref=AN2_107_SL

CVE-2021-22733

A CWE-269: Improper Privilege Management vulnerability exists that could cause shell
access when unauthorized code is loaded into the system folder.

CVE Description

CVE-2021-22734

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could
cause remote code execution when an attacker loads unauthorized code.

CVE Description

CVE-2021-22735

A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could
allow remote code execution when unauthorized code is copied to the device.

CVE Description

CVE-2021-22736

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulnerability exists that could cause a denial of service when an unauthorized file is uploaded.

CVE Description

CVE-2021-22737

A CWE-307: Improper Restriction of Excessive Authentications Attempts vulnerability exists that could cause unauthorized access of when credentials are discovered after a brute force attack.

CVE Description

CVE-2021-22738

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could
cause unauthorized access when credentials are discovered after a brute force attack.

CVE Description

CVE-2021-22739

A CWE-200: Information Exposure vulnerability exists that could cause a device to be
compromised when it is first configured.

CVE Description

Exposure of Sensitive Information to an Unauthorized Actor

CVE-2021-22740

A CWE-200: Information Exposure vulnerability exists that could cause information to be
exposed when an unauthorized file is uploaded.

CVE Description


Modicon M241 & M251 Logic Controllers

Summary: Original Release

Summary: Modicon M241 & M251 Logic Controllers - SEVD-2021-130-05 PDF Version

Summary: Modicon M241 & M251 Logic Controllers - SEVD-2021-130-05 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon M241/M251 logic controllers.
The Modicon M241 and M251 are Programmable Logic Controllers for performance-demanding
applications.
Failure to apply the remediations provided below may risk a buffer overflow attack, which could
result in the unavailability of the controller.

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance removing a patch.

Overview

Schneider Electric

Modicon M241/M251 logic controllers

Schneider Electric Modicon M241/M251 logic controllers firmware prior to V5.1.9.1

Modicon M241/M251 Logic Controllers

Schneider Electric Modicon M241/M251 Logic Controllers V5.1.9.14

CVE-2021-22699

CWE-20: Improper Input Validation vulnerability exists that could cause denial of
service when specific crafted requests are sent to the controller over HTTP.

CVE Description

Marcin Dudek
Kinga Staszkiewicz
Jakub Suchorab
Joanna Walkiewicz

National Centre for Nuclear Research Poland

A fix for this vulnerability is available by following the steps below:
1. Update Software -
On the engineering workstation, update to EcoStruxure Machine Expert V2.0 or above.
2. Update Firmware -
On Modicon M241/M251 Logic Controllers, update to firmware version V5.1.9.14 or
higher available within EcoStruxure Machine Expert V2.0. A reboot is needed.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and configure Modicon M241/M251 firewall to block all
unauthorized access to ports TCP 80/443.


EcoStruxure Geo SCADA Expert

Summary: Original Release

Summary: EcoStruxure Geo SCADA Expert - SEVD-2021-130-07 PDF Version

Summary: EcoStruxure Geo SCADA Expert - SEVD-2021-130-07 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure Geo SCADA Expert products
(formerly known as ClearSCADA).
The EcoStruxure Geo SCADA Expert product is an open, flexible and scalable software system
for telemetry and remote SCADA solutions.
Failure to apply the remediations provided below may risk the revealing of account credentials,
which could result in unauthorized system access.

Overview

Schneider Electric

ClearSCADA

Schneider Electric ClearSCADA All Versions

EcoStruxure Geo SCADA Expert 2019

Schneider Electric EcoStruxure Geo SCADA Expert 2019 All Versions

EcoStruxure Geo SCADA Expert 2020

Schneider Electric EcoStruxure Geo SCADA Expert 2020 V83.7742.1 and prior

Geo SCADA Expert 2020 April 2021

Schneider Electric Geo SCADA Expert 2020 April 2021 83.7787.1

CVE-2021-22741

CWE-916: Use of Password Hash with Insufficient Computational Effort vulnerability
exists that could cause the revealing of account credentials when server database files are
available. Exposure of these files to an attacker can make the system vulnerable to password
decryption attacks. Note that “.sde” configuration export files do not contain user account
password hashes.

CVE Description

Use of Password Hash With Insufficient Computational Effort

Geo SCADA Expert 2020 April 2021 (83.7787.1) includes a fix for this vulnerability. The security
of stored passwords in the servers is significantly strengthened. It is available for download
here:
Installation of new server software will require system restart or changeover of redundant
servers. Consult the Release Notes and Resource Center for advice on the procedure.
Customers should use appropriate update methodologies when applying these updates to their
systems. We strongly recommend the use of back-ups and evaluating the impact of these
updates in a Test and Development environment or on an offline infrastructure.
Contact Schneider Electric's Customer Care Center if you need assistance removing a patch.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
All customers should take steps to protect their database files, particularly the 'Config' files
within the Program Data\Schneider Electric\ClearSCADA folder and their backup files. With
Geo SCADA Expert 2019 and onwards, access to these files can be set for LocalSystem and
Administrators access only. Systems running earlier versions should have file ACL added
appropriately.


Summary: Original Release

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2021-159-01 PDF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2021-159-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the Interactive Graphical SCADA
System (IGSS) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling
industrial processes. IGSS communicates with all major industry standard PLC drivers.
Failure to apply the remediations provided below may risk remote code execution, which could
result in an attacker gaining access to the Windows Operating System on the machine used to
import CGF and WSP files, typically a step performed during system design time.

Overview

Overview

Schneider Electric

IGSS Definition (Def.exe)

Schneider Electric IGSS Definition (Def.exe) V15.0.0.21041 and prior

Schneider Electric IGSS Definition (Def.exe) V15.0.0.21140 and prior

IGSS Definition module: Def.exe

Schneider Electric IGSS Definition module: Def.exe Version 15.0.0.21141

CVE-2021-22750

CWE-787: Out-of-bounds write vulnerability exists that could result in loss of data or remote
code execution due to missing length checks, when a malicious CGF file is imported to IGSS
Definition.

CVE Description

Version 15.0.0.21141 of the IGSS Definition module: Def.exe includes fixes for these
vulnerabilities and is available for download through IGSS Master > Update IGSS Software or
here:
https://igss.schneider-electric.com/igss/igssupdates/v150/IGSSUPDATE.ZIP

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Avoid importing CGF and WSP files from untrusted sources.

CVE-2021-22751

CWE-787: Out-of-bounds write vulnerability exists that could result in disclosure of information
or execution of arbitrary code due to lack of input validation, when a malicious CGF
(Configuration Group File) file is imported to IGSS Definition.

CVE Description

CVE-2021-22752

CWE-787: Out-of-bounds write vulnerability exists that could result in loss of data or remote
code execution due to missing size checks, when a malicious WSP (Workspace) file is being
parsed by IGSS Definition.

CVE Description

CVE-2021-22753

CWE-125: Out-of-bounds read vulnerability exists that could result in loss of data or remote
code execution due to missing length checks, when a malicious WSP file is being parsed by
IGSS Definition.

CVE Description

CVE-2021-22754

CWE-787: Out-of-bounds write vulnerability exists that could result in loss of data or remote
code execution due to lack of proper validation of user-supplied data, when a malicious CGF file
is imported to IGSS Definition.

CVE Description

CVE-2021-22755

CWE-787: Out-of-bounds write vulnerability exists that could result in disclosure of information
or remote code execution due to lack of sanity checks on user-supplied data, when a malicious
CGF file is imported to IGSS Definition.

CVE Description

CVE-2021-22756

CWE-125: Out-of-bounds read vulnerability exists that could result in disclosure of information
or remote code execution due to lack of user-supplied data validation, when a malicious CGF
file is imported to IGSS Definition.

CVE Description

CVE-2021-22757

CWE-125: Out-of-bounds read vulnerability exists that could result in disclosure of information
or remote code execution due to lack of sanity checks on user-supplied input data, when a
malicious CGF file is imported to IGSS Definition.

CVE Description

CVE-2021-22758

CWE-824: Access of uninitialized pointer vulnerability exists that could result in loss of data or
remote code execution due to lack validation of user-supplied input data, when a malicious CGF
file is imported to IGSS Definition.

CVE Description

CVE-2021-22759

CWE-416: Use after free vulnerability exists that could result in loss of data or remote code
execution due to use of unchecked input data, when a malicious CGF file is imported to IGSS
Definition.

CVE Description

CVE-2021-22760

CWE-763: Release of invalid pointer or reference vulnerability exists that could result in loss
of data or remote code execution due to missing checks of user-supplied input data, when a
malicious CGF file is imported to IGSS Definition.

CVE Description

CVE-2021-22761

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could result in disclosure of information or remote code execution due to
missing length check on user supplied data, when a malicious CGF file is imported to IGSS
Definition.

CVE Description

CVE-2021-22762

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result
in remote code execution, when a malicious CGF or WSP file is being parsed by IGSS
Definition.

CVE Description