EcoStruxure Power Commission

Summary: Original Release

Summary: EcoStruxure Power Commission - SEVD-2022-347-03 PDF Version

Summary: EcoStruxure Power Commission - SEVD-2022-347-03 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Power Commission software product.
The EcoStruxure Power Commission software is an intelligent software that helps you easily set up, test, and commission the electrical products and systems in your switchboards.
Failure to apply the remediations provided below may risk unauthorized access to application and information disclosure, which could result in loss of data integrity and confidentiality.

Overview

Schneider Electric

EcoStruxure Power Commission

Schneider Electric EcoStruxure Power Commission version prior to 2.25

Schneider Electric EcoStruxure Power Commission version 2.26

CVE-2022-4062

A CWE-285: Improper Authorization vulnerability exists that could cause unauthorized access to certain software functions when an attacker gets access to localhost interface of the EcoStruxure Power Commission application.

CVE Description

Version 2.26 of EcoStruxure Power Commission includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/62980-ecostruxure-power-commission/#software-and-firmware


Summary: Original Release

Summary: EcoStruxureTM Machine Expert – HVAC (formerly SoMachine - HVAC) - SEVD-2023-010-01 PDF Version

Summary: EcoStruxureTM Machine Expert – HVAC (formerly SoMachine - HVAC) - SEVD-2023-010-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in EcoStruxureTM Machine Expert - HVAC (formerly SoMachine - HVAC).
The EcoStruxureTM Machine Expert - HVAC is a commissioning software for programmable logic controllers M171/M172. The EcoStruxureTM Machine Expert - HVAC is a commissioning software for programmable logic controllers M171/M172.
Failure to apply the mitigations provided below may lead to sensitive information leakage that can potentially be used to execute arbitrary code.

Overview

Schneider Electric

SoMachine HVAC

Schneider Electric SoMachine HVAC version prior to 2.1.0

EcoStruxureTM Machine Expert – HVAC

Schneider Electric EcoStruxureTM Machine Expert – HVAC version prior to 1.4.0

Schneider Electric EcoStruxureTM Machine Expert – HVAC version 1.5.0

CVE-2022-2988

A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning software.

CVE Description

Version 1.5.0 of EcostruxureTM Machine Expert - HVAC includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/SoMachine+HVAC+-+Programming+Software+for+Modicon+M171-M172+Logic+Controllers/
No reboot is required.
It is recommended that customers using SoMachine - HVAC upgrade to EcostruxureTM Machine Expert – HVAC.


EcoStruxure Geo SCADA Expert

Summary: Original Release

Summary: Adjustment of the deprecated CWE of the CVE-2023-22610.

Summary: EcoStruxure Geo SCADA Expert - SEVD-2023-010-02 PDF Version

Summary: EcoStruxure Geo SCADA Expert - SEVD-2023-010-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure Geo SCADA Expert software product, formerly known as ClearSCADA.
The EcoStruxure Geo SCADA Expert product is an open, flexible and scalable software for telemetry and remote SCADA solutions.
If successfully exploited, bad actors could execute a range of actions, including accessing and disclosing sensitive information, and denial of service.
Failure to apply the remediations provided below may risk unauthorized system access, which could result in SCADA configuration data being exposed or a loss of service.

Overview

Schneider Electric

EcoStruxure Geo SCADA Expert 2019

Schneider Electric EcoStruxure Geo SCADA Expert 2019 version 81.8267.1 and prior

EcoStruxure Geo SCADA Expert 2020

Schneider Electric EcoStruxure Geo SCADA Expert 2020 version 83.8267.1 and prior

EcoStruxure Geo SCADA Expert 2021

Schneider Electric EcoStruxure Geo SCADA Expert 2021 version 84.8269.1 and prior

ClearSCADA

Schneider Electric ClearSCADA All Versions

EcoStruxure Geo SCADA Expert 2019

Schneider Electric EcoStruxure Geo SCADA Expert version 2019 81.8333.1

EcoStruxure Geo SCADA Expert 2020

Schneider Electric EcoStruxure Geo SCADA Expert version 2020 83.8332.1

EcoStruxure Geo SCADA Expert 2021

Schneider Electric EcoStruxure Geo SCADA Expert version 2021 84.8335.2

CVE-2023-22610

A CWE-863: Incorrect Authorization vulnerability exists that could cause Denial of Service against the Geo SCADA server when specific messages are sent to the server over the database server TCP port.

CVE Description

The UK's National Cyber Security Centre (NCSC)

The October 2022 Updates of EcoStruxure Geo SCADA Expert include fixes for these vulnerabilities and are available for download here: https://community.se.com/t5/Geo-SCADA-Knowledge-Base/Geo-SCADA-Expert-Downloads/ba-p/279115
Installation of new server software will require a system restart or changeover of redundant servers. Consult the Release Notes and Exchange Knowledge Base (Resource Center) for advice on the procedure:
https://community.exchange.se.com/t5/Geo-SCADA-Knowledge-Base/Resource-Center-Home/ba-p/279133
The documentation also states how to verify the installed version.

We recommend upgrading to the software versions listed in the section above. Customers using ClearSCADA should also upgrade to the latest GeoSCADA release.

CVE-2023-22611

A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure when specific messages are sent to the server over the database server TCP port.

CVE Description


Summary: Original Release

Summary: EcoStruxure™ Power Operation 2021, EcoStruxure™ Power SCADA Operation 2020 and EcoStruxure™ Power SCADA Operation 2020 R2 - SEVD-2023-010-03 PDF Version

Summary: EcoStruxure™ Power Operation 2021, EcoStruxure™ Power SCADA Operation 2020 and EcoStruxure™ Power SCADA Operation 2020 R2 - SEVD-2023-010-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Operation and Power SCADA Operation software
EcoStruxure™ Power Operation and EcoStructure™ Power SCADA Operation are on-premises software offers that provides a single platform to monitor and control medium and lower power systems.
Failure to apply the remediation provided below may risk loss of communications via the 61850 protocol, which could result in loss of communications to downstream devices and services.

Overview

Schneider Electric

EcoStruxure™ Power SCADA Operation 2020

2020 & 2020 CU1

Schneider Electric EcoStruxure™ Power SCADA Operation 2020 Version 2020 and 2020 CU1

Schneider Electric EcoStruxure™ Power SCADA Operation 2020 R2 Version 2020 R2 and 2020 R2 CU1, 2020 R2 CU2, and 2020 R2 CU3

EcoStruxure™ Power Operation 2021

2021, 2021 CU1, 2021 CU2 & 2021 CU3

Schneider Electric EcoStruxure™ Power Operation 2021 Version 2021, 2021 CU1, 2021 CU2 and 2021 CU3

Power SCADA Operation

Schneider Electric Power SCADA Operation version 9.0

PowerSCADA Expert

Schneider Electric PowerSCADA Expert version 8.x

IEC61850 Driver

Schneider Electric IEC61850 Driver version 1.08.00.000

Power SCADA Operation 9.0

Contact Support

Schneider Electric Power SCADA Operation 9.0 Contact Support

PowerSCADA Expert 8.x

Contact Support

Schneider Electric PowerSCADA Expert 8.x Contact Support

CVE-2022-38138

A CWE-824: Access of uninitialized Pointer vulnerability exists that could cause a denial-of-service condition if exploited.

CVE Description

An updated driver package is available for download here:
https://community.se.com/t5/EcoStruxure-Power-Operation/IEC61850-Driver-Latest-Release/m-p/150118


EcoStruxure™ Power SCADA Anywhere

Summary: Original Release

Summary: EcoStruxure™ Power SCADA Anywhere - SEVD-2023-010-04 PDF Version

Summary: EcoStruxure™ Power SCADA Anywhere - SEVD-2023-010-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power SCADA Anywhere product.
EcoStruxure™ Power SCADA Anywhere is an on-premises software that provides remote web browser access to the EcoStruxure Power Operation desktop HMI client application and its operator interface.
Failure to apply with the mitigations provided below may risk an authenticated user to escape from the context of EcoStruxure™ Power SCADA Anywhere into the Operating System (OS), which could result in arbitrary OS commands being executed on the system.

Overview

Schneider Electric

EcoStruxure™ Power SCADA Anywhere

Schneider Electric EcoStruxure™ Power SCADA Anywhere version 2022

Schneider Electric EcoStruxure™ Power SCADA Anywhere version 2021

EcoStruxure™ Power SCADA Anywhere

2020 R2

Schneider Electric EcoStruxure™ Power SCADA Anywhere version 2020 R2

Schneider Electric EcoStruxure™ Power SCADA Anywhere version 9.0

Schneider Electric EcoStruxure™ Power SCADA Anywhere version 8.x

CVE-2022-1467

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause an authenticated user to run arbitrary OS commands at restricted privileged levels if exploited.

CVE Description

Windows OS can be configured to overlay a “Language Bar” on top of any application. When this OS functionality is enabled, the OS Language Bar UI will be viewable in the browser alongside EcoStruxure™ Power SCADA Anywhere. It is possible to abuse the Windows OS Language Bar to launch an OS Command Prompt, resulting in a context-escape from application into OS.
Schneider Electric recommends that organizations evaluate the impact of this vulnerability based on their operational environment, architecture, and product implementation. If impacted, we recommend customers consider applying the following mitigations to reduce the risk of exploit:
• Disable the Windows Language Bar on the server machine hosting EcoStruxure™ Power SCADA Anywhere, unless it is required for corporate policy.
• Create unique user accounts with minimal privileges dedicated only to remote access of the EcoStruxure™ Power SCADA Anywhere application.
• Utilize OS Group Policy Objects (GPO) to further restrict what those unique user accounts are allowed to do.
• Restrict access based on Microsoft’s recommended block list:
https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp


Summary: Original Release

Summary: A remediation for Modicon M340 is available for download. The qualitative severity rating of this vulnerability was corrected to “high” to reflect the CVSS Base score.

Summary: A remediation for Modicon MC80 is available for download

Summary: All versions of the EcoStruxure™ Process Expert are impacted by this vulnerability

Summary: A remediation is available for the Modicon M580 CPU Safety (page 2).

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) - SEVD-2023-010-05 PDF Version

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) - SEVD-2023-010-05 CSAF Version

Public

General Security Recommendations

The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Note regarding vulnerability details

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert and Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers).
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way.
EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers).
The EcoStruxure™ Process Expert DCS is a single automation system to engineer, operate, and maintain your entire infrastructure for a sustainable, productive and market-agile plant.
Failure to apply the mitigations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.
March 2023 Update: Remediation for EcoStruxure™ Control Expert, Modicon M580 CPU, and Momentum Unity M1E Processor are available for download (page 2). Additional mitigations for Modicon M340 were added.

Overview

Schneider Electric

EcoStruxure™ Control Expert

Schneider Electric EcoStruxure™ Control Expert version 15.2 and prior

EcoStruxure™ Process Expert

Schneider Electric EcoStruxure™ Process Expert All Versions

Schneider Electric EcoStruxure™ Process Expert version 2021

Modicon M340 CPU

Schneider Electric Modicon M340 CPU versions prior to SV3.51

Schneider Electric Modicon M340 CPU version SV3.51

Modicon M580 CPU

Schneider Electric Modicon M580 CPU Versions SV4.10 and prior

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (BMEP58*S and BMEH58*S) Versions prior to SV4.21

Schneider Electric Modicon M580 CPU Safety (BMEP58*S and BMEH58*S) Version SV4.21

Modicon Momentum Unity M1E Processor

Schneider Electric Modicon Momentum Unity M1E Processor versions prior to SV2.6

Modicon MC80

Schneider Electric Modicon MC80 versions prior to SV1.90

Legacy Modicon Quantum CPUs

Schneider Electric Legacy Modicon Quantum CPUs all versions

Legacy Modicon Premium CPUs

Schneider Electric Legacy Modicon Premium CPUs all versions

Modicon M580 CPU

Schneider Electric Modicon M580 CPU version 4.10

Modicon Momentum Unity M1E Processor

Schneider Electric Modicon Momentum Unity M1E Processor version 2.6

Modicon MC80

Schneider Electric Modicon MC80 version SV1.90

CVE-2022-45788

A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of confidentiality & integrity when a malicious project file is loaded onto the controller.

CVE Description

Schneider Electric is establishing a remediation plan for all future versions of EcoStruxure™ Process Expert that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:
 • Setup a VPN between the Modicon PLC controllers and the engineering workstation containing EcoStruxureTM Process Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.
 • Encrypt project files when stored and restrict the access to only trusted users.
 • When exchanging files over the network, use secure communication protocols.
 • Only open project files received from trusted source.
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage.
 Harden the workstation running EcoStruxure™ Process Expert.

Software V15.3 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/EcoStruxureControlExpert-V15.3/

Firmware SV3.51 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468- modicon-m340/#software-and-firmware

Firmware SV4.10 includes a fix for this vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/

Firmware SV4.21 includes a fix for this vulnerability and
is available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-pac-controller/#software-andfirmware
Important: customer needs to use version of
EcoStruxure™ Control Expert v16.0 HF001 minimum to
connect with the latest version of M580 CPU Safety.
The software is available for download here:
https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-andfirmware

If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
• “Modicon M580, Hardware, Reference Manual” https://www.se.com/ww/en/download/document/EIO0000001578/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/
OR
• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
OR
• Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections for M340 & M580 architectures. For more details refer to the chapter “How to protect M580 and M340 architectures with EAGLE40 using VPN”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M580 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
• NOTE: The CPU memory protection cannot be configured with M580 Hot Standby CPUs. In such cases, use IPsec encrypted communication.
To further reduce the attack surface on Modicon M580 CPU Safety:
• Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document ModiconM580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

Firmware SV2.6 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/Momentum_FW_update/

If customers choose not to apply the remediation, then they should immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
• “Momentum for EcoStruxure™ Control Expert – 171 CBU 78090, 171 CBU 98090, 171 CBU 98091 Processors”
manual in the chapter “Modbus Messaging and Access Control”: https://www.se.com/ww/en/download/document/HRB44124/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/

If customers choose not to apply the remediation, then they should immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals: “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
• use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
OR
• Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350
OR
• Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections for M340 & M580 architectures. For more details refer to the chapter “How to protect M580 and M340 architectures with EAGLE40 using VPN”: https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M580 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
• NOTE: The CPU memory protection cannot be configured with M580 Hot Standby CPUs. In such cases, use IPsec encrypted communication.

If customers choose not to apply the remediation, it is recommended to apply the following mitigations to reduce the risk of the exploit:
• Setup a VPN between the Modicon PLC controllers and the engineering workstation containing EcoStruxureTM Control Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.
• Harden the workstation running EcoStruxure™ Control Expert.
• It is recommended to enable the file encryption feature for all new projects.
• Encrypt project files when stored and restrict the access to only trusted users.
• When exchanging files over the network, use secure communication protocols.
• Only open project files received from trusted source, and it is recommended to share project files only when configured with the encryption feature described above.
• Compute a hash of the project files and regularly check the consistency of this hash to verify the integrity before usage.

Firmware SV1.90 includes a fix for this vulnerability and is available for download here:

Schneider Electric’s Modicon Premium & Quantum controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our most current product offer.
Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.
To mitigate the risks users should immediately:
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manual “Premium and Atrium using EcoStruxure™ Control Expert – Ethernet Network Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP Services Configuration Parameters / Connection Configuration Parameters”: https://www.se.com/ww/en/download/document/35006192K01000/


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert, Modicon M340, Momentum, MC80, M580 and M580 CPU Safety. The Modicon M580 are PAC and Safety PLCs with built-in Ethernet for process, high availability & safety solutions. The Modicon M340 offers compactness, flexibility, scalability, and robustness for the process industry and a wide range of demanding automation applications. The Modicon MC80 provides optimized operation, withstanding extreme conditions with high reliability and performance. The Modicon Momentum supports control and distributed I/O system with 4 fundamental components that easily snap together in various combinations to form versatile control systems or sub-systems. EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers). Failure to apply the mitigations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality and integrity of the controller.

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 CPU Safety - SEVD-2023-010-06 PDF Version

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 CPU Safety - SEVD-2023-010-06 CSAF Version

Summary: Original Release

Summary: Modicon Momentum Unity M1E Process (page 6) and Modicon MC80 were added to the impacted products with the mitigations (page 7).

Summary: A remediation is available for Modicon M580 CPU Safety(page 2).

Summary: Remediations are available for EcoStruxure Control Expert, Modicon Momentum, and Modicon M340.

Schneider Electric

EcoStruxure™ Control Expert

EcoStruxure™ Control Expert Versions prior to V16.2 HF003

EcoStruxure™ Control Expert

16.2 HF003

EcoStruxure™ Control Expert Version V16.2 HF003

Modicon M340 CPU

Modicon M340 CPU Firmware versions prior to SV3.70

Modicon M580 CPU

Modicon M580 CPU versions prior to SV4.20

Modicon M580 CPU Safety

Modicon M580 CPU Safety Versions prior to SV4.21

Modicon Momentum Unity M1E Processor

Modicon M340 Firmware versions prior to SV3.70 installed on Modicon M340 CPU (part numbers BMXP34*)

Modicon M340 Firmware Version SV3.70 installed on Modicon M340 CPU (part numbers BMXP34*)

Modicon Momentum Unity M1E Processor Firmware Versions prior to SV2.90 installed on Modicon Momentum Unity M1E Processor (171CBU*)

Modicon Momentum Unity M1E Processor Firmware Version SV2.90 installed on Modicon Momentum Unity M1E Processor (171CBU*)

A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could
cause execution of unauthorized Modbus functions on the controller when hijacking an
authenticated Modbus session.

CVE Description

CVSS v4.0 Base Score 9.2 | Critical | [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0  Score

Firmware SV4.20 includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware

Firmware SV4.21 includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/product-range/62098-modicon-m580-pac-controller/#software-and-firmware Important: customer needs to use the version of EcoStruxure™ Control Expert v16.0 HF001 minimum to connect with the latest version of M580 CPU Safety. The software is available for download here: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware

EcoStruxure™ Control Expert V16.2 HF003 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware

Firmware SV2.90 includes a fix for this vulnerability and is available for download here:https://www.se.com/ww/en/product-range/535-modicon-momentum/?parent-category-id=3900&parent-subcategory-id=3930&filter=business-1-industrial-automation-and-control#products

Version 3.70 of Modicon M340 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware

Customers should immediately apply the following mitigations to reduce the risk of exploit:• Setup a VPN between the Modicon PLC controllers and the engineering workstation containing EcoStruxureTM Control Expert. Note: this functionality may be provided by an external IPSEC compatible firewall located close to the controller.• Harden the workstation running EcoStruxure™ Control Expert.

If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties.
• Setup network segmentation and implement a firewall to
block all unauthorized access to port 502/TCP.
• Configure the Access Control List following the
recommendations of the user manuals:
o “Modicon M340 for Ethernet Communications
Modules and Processors User Manual” in chapter
“Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/
• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Consider the use of external firewall devices such as
EAGLE40-07 from Belden to establish VPN connections for
M340 & M580 architectures. For more details refer to the
chapter “How to protect M580 and M340 architectures with
EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO0000001999/

If customers choose not to apply the remediation, it is recommended to apply the following mitigations to reduce the risk of the exploit:• Setup an application password in the project properties. • Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP. • Configure the Access Control List following the recommendations of the user manuals: o “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/ • Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/ o use a BMENOC module and follow the instructions to configure IPSEC feature as described in the guideline “Modicon M580 - BMENOC03.1 Ethernet Communications Schneider Electric Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”: https://www.se.com/ww/en/download/document/HRB62665/ OR • Use a BMENUA0100 module and follow the instructions to configure IPSEC feature as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”: https://www.se.com/ww/en/download/document/PHA83350 OR • Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections for M340 & M580 architectures. For more details refer to the chapter “How to protect M580 and M340 architectures with EAGLE40 using VPN”: https://www.se.com/ww/en/download/document/EIO0000001999/ • Ensure the M580 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneiderelectric.com/en/download/document/EIO0000001999/ o NOTE: The CPU memory protection cannot be configured with M580 Hot Standby CPUs. In such cases, use IPsec encrypted communication.

If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties.
• Setup network segmentation and implement a firewall to
block all unauthorized access to port 502/TCP.
• Configure the Access Control List following the
recommendations of the user manuals:
o “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO0
000001578/
• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup secured
communications”:
https://www.se.com/ww/en/download/document/EIO0000001
999/
o use a BMENOC module and follow the instructions to
configure IPSEC feature as described in the guideline
“Modicon M580 - BMENOC03.1 Ethernet
Communications Schneider Electric Security
Notification Module, Installation and Configuration
Guide” in the chapter “Configuring IPSEC
communications”:
OR
• Use a BMENUA0100 module and follow the instructions to
configure IPSEC feature as described in the chapter
“Configuring the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
OR
• Consider use of external firewall devices such as EAGLE40-
07 from Belden to establish VPN connections for M340 &
M580 architectures. For more details refer to the chapter
“How to protect M580 and M340 architectures with EAGLE40
using VPN”:
https://www.se.com/ww/en/download/document/EIO0000001
999/
• Ensure the M580 CPU is running with the memory protection
activated by configuring the input bit to a physical input, for
more details refer to the following guideline “Modicon
Controllers Platform Cyber Security Reference Manual”,
“CPU Memory Protection section”: https://www.schneiderelectric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be
configured with M580 Hot Standby CPUs. In such
cases, use IPsec encrypted communication.
To further reduce the attack surface on Modicon M580 CPU Safety:
o Ensure the CPU is running in Safety mode and
maintenance input is configured to maintain this
Safety mode during operation – refer to the document
Modicon M580 - Safety System Planning Guide - in
the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:• “Momentum for EcoStruxure™ Control Expert – 171 CBU 78090, 171 CBU 98090, 171 CBU 98091 Processors” manual in the chapter “Modbus Messaging and Access Control”: https://www.se.com/ww/en/download/document/HRB44124/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/

Schneider Electric is establishing a remediation plan for all future versions of Modicon MC80 controllers that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the user manuals:
• “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)”: https://www.se.com/ww/en/download/document/EIO0000002071/
• Setup a secure communication according to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured communications”: https://www.se.com/ww/en/download/document/EIO0000001999/

CVE-2022-45789


EcoStruxureTM Geo SCADA Expert

Summary: Original Release

Summary: EcoStruxureTM Geo SCADA Expert - SEVD-2023-045-01 PDF Version

Summary: EcoStruxureTM Geo SCADA Expert - SEVD-2023-045-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxureTM Geo SCADA Expert software product, formerly known as ClearSCADA.
The EcoStruxureTM Geo SCADA Expert product is an open, flexible and scalable software for telemetry and remote SCADA solutions.
If successfully exploited, bad actors could arbitrarily inject text entries into product log files, including falsified entries, or filling the log files with bad data.
Failure to apply the remediation provided below may risk the compromise of product log files.

Overview

Schneider Electric

EcoStruxureTM Geo SCADA Expert 2021

Schneider Electric EcoStruxureTM Geo SCADA Expert 2021 version 84.8269.1 and prior

EcoStruxureTM Geo SCADA Expert 2020

Schneider Electric EcoStruxureTM Geo SCADA Expert 2020 version 83.8267.1 and prior

EcoStruxureTM Geo SCADA Expert 2019

Schneider Electric EcoStruxureTM Geo SCADA Expert 2019 version 81.8267.1 and prior

ClearSCADA

Schneider Electric ClearSCADA version 80.8015.1 and prior

EcoStruxureTM Geo SCADA Expert 2021

Schneider Electric EcoStruxureTM Geo SCADA Expert 2021 version 84.8335.2

EcoStruxureTM Geo SCADA Expert 2020

Schneider Electric EcoStruxureTM Geo SCADA Expert 2020 version 83.8332.1

EcoStruxureTM Geo SCADA Expert 2019

Schneider Electric EcoStruxureTM Geo SCADA Expert 2019 version 81.8333.1

CVE-2023-0595

A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious packets are sent to the Geo SCADA server's database web port (default 443)

CVE Description

The October 2022 Updates of EcoStruxure TM Geo SCADA Expert include fixes for these vulnerabilities and are available for download here: https://community.se.com/t5/Geo-SCADA-Knowledge-Base/Geo-SCADA-Expert-Downloads/ba-p/279115
Installation of new server software will require a system restart or changeover of redundant servers. Consult the Release Notes and Exchange Knowledge Base (Resource Center) for advice on the procedure:
https://community.exchange.se.com/t5/Geo-SCADA-Knowledge-Base/Resource-Center-Home/ba-p/279133
Please read the product documentation to understand how to set up client and server certificates and how to configure connections to restrict to client versions supporting certificates.
The documentation also states how to verify the installed version.

To mitigate these vulnerabilities, we recommend restricting access to the Geo SCADA server's database web port (default 443). Access should be available only to ViewX and WebX clients.
Refer to the Geo SCADA Expert Help documentation for advice and best practices for putting networks and remote devices behind firewalls and isolating them from the business network and public networks. Specific advice is listed below:
• Configure the Geo SCADA Server’s Client Access Control list, which prevents unauthorized IP addresses from connecting.
We recommend upgrading to the software versions listed in the section above. Customers using ClearSCADA should also upgrade.


StruxureWare Data Center Expert

Summary: Original Release

Summary: StruxureWare Data Center Expert - SEVD-2023-045-02 PDF Version

Summary: StruxureWare Data Center Expert - SEVD-2023-045-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its StruxureWare Data Center Expert product.
The StruxureWare Data Center Expert product is a scalable monitoring software that collects, organizes, and distributes critical device information providing a comprehensive view of equipment.
Failure to apply the remediations provided below may risk remote access and/or Local Privilege Escalation, which could result in loss of control and loss of availability of the appliance.

Overview

Schneider Electric

StruxureWare Data Center Expert

Schneider Electric StruxureWare Data Center Expert version 7.9.2 and prior

Schneider Electric StruxureWare Data Center Expert version 7.9.3

CVE-2023-25547

A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker is using a low privileged user account.

CVE Description

Version 7.9.3 of StruxureWare Data Center Expert includes fixes for these vulnerabilities and is available on request from Schneider Electric’s Customer Care Center.

CVE-2023-25548

A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being properly secured when a hacker is using a low privileged user.

CVE Description

CVE-2023-25552

A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, or performing unauthorized functions when tampering the Device File Transfer settings on DCE endpoints.

CVE Description

CVE-2023-25554

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a local privilege escalation on the appliance when a maliciously crafted Operating System command is entered on the device.

CVE Description

CVE-2023-25549

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when using a parameter of the DCE network settings endpoint.

CVE Description

CVE-2023-25550

A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the “hostname” parameter when maliciously crafted hostname syntax is entered.

CVE Description

CVE-2023-25551

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE file upload endpoint when tampering with parameters over HTTP.

CVE Description

CVE-2023-25553

A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE endpoint through the logging capabilities of the webserver.

CVE Description

CVE-2023-25555

A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow a user that knows the credentials to execute unprivileged shell commands on the appliance over SSH.

CVE Description


Merten KNX devices

Summary: Original Release

Summary: Merten KNX devices - SEVD-2023-045-03 PDF Version

Summary: Merten KNX devices - SEVD-2023-045-03 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Merten KNX products.
The Merten KNX products in the table below are home automation products for lighting and
temperature control.
Failure to apply the mitigations provided below may risk an authentication attack against the
BCU Key, which could result in a compromised product.

Overview

Schneider Electric Merten INSTABUS Tastermodul 1fach System M 625199 version 1.0

Schneider Electric Merten INSTABUS Tastermodul 2fach System M 625299 version 1.0

Schneider Electric Merten Tasterschnittstelle 4fach plus 670804 version 1.0

Schneider Electric Merten Tasterschnittstelle 4fach plus 670804 version 1.2

Schneider Electric Merten KNX ARGUS 180/2,20M UP SYSTEM 631725 version 1.0

Schneider Electric Merten Jalousie-/Schaltaktor REG-K/8x/16x/10 m. HB 649908 (Product discontinued) version 1.0

Schneider Electric Merten KNX Uni-Dimmaktor LL REG-K/2x230/300 W MEG6710-0002 (Product discontinued) version 1.0

Schneider Electric Merten KNX Uni-Dimmaktor LL REG-K/2x230/300 W MEG6710-0002 (Product discontinued) version 1.1

Schneider Electric Merten KNX Schaltakt.2x6A UP m.2 Eing. MEG6003-0002 (Product discontinued) version 0.1

CVE-2023-25556

A CWE-287: Improper Authentication vulnerability exists that could allow a device to be
compromised when a key of less than seven digits is entered and the attacker has access to the
KNX installation.

CVE Description

FH Aachen - University of Applied Sciences

Customers must request
their system integrator to
increase their BCU Key to
8 digits.


EcoStruxure™ Power Monitoring Expert

Summary: Original Release

Summary: There is a remediation available for EcoStruxure™ Power Monitoring Expert 2021

Summary: EcoStruxure™ Power Operation has been added to the Affected Products table.

Summary: EcoStruxure™ Power Monitoring Expert - SEVD-2023-073-01 PDF Version

Summary: EcoStruxure™ Power Monitoring Expert - SEVD-2023-073-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert product (PME).
EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power-critical and energy-intensive facilities maximize uptime and operational efficiency.
Failure to apply the mitigation provided below may risk a session expiration vulnerability, which would allow an attacker unauthorized access over a hijacked session.

Overview

Schneider Electric

EcoStruxure™ Power Monitoring Expert Version 2022 and prior

2022 CU1

Schneider Electric EcoStruxure™ Power Monitoring Expert version 2022 CU1

Schneider Electric EcoStruxure™ Power Monitoring Expert versions Prior to 2021

2021 CU2

Schneider Electric EcoStruxure™ Power Monitoring Expert version 2021 CU2

EcoStruxure™ Power Operation (EPO)

<=2022 CU4

Schneider Electric EcoStruxure™ Power Operation Versions 2022 CU4 and prior

EcoStruxure™ Power Operation (EPO)

2022 CU5

Schneider Electric EcoStruxure™ Power Operation Version 2022 CU5

EcoStruxure™ Power Operation (EPO)

<=2021 CU3 Hotfix 2

Schneider Electric EcoStruxure™ Power Operation Versions 2021 CU3 Hotfix 2 and prior

EcoStruxure™ Power Operation (EPO)

2021 CU3 Hotfix 3

Schneider Electric EcoStruxure™ Power Operation Version 2021 CU3 Hotfix 3

Schneider Electric EcoStruxure™ Power Operation Prior to version 2021

CVE-2023-28003

A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to
maintain unauthorized access over a hijacked session in PME after the legitimate user has signed out of their account.

CVE Description

EcoStruxure™ Power Monitoring Expert 2022 CU1 includes a fix for this vulnerability and is available for download here:
https://ecoxpert.se.com/software-center/power-monitoring-expert/power-monitoring-expert-2022

EcoStruxure™ Power Monitoring Expert 2021 CU2 includes a fix for this vulnerability and is available for download here: https://ecoxpert.se.com/software-center/power-monitoring-expert/power-monitoring-expert-2021

EcoStruxure™ Power Operation 2022 CU5 includes a fix for this vulnerability and is available for download here:https://community.se.com/t5/EcoStruxure-Power-Operation/v2022-Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058

EcoStruxure™ Power Operation 2021 CU3 Hotfix 3 includes a fix for this vulnerability and is available for download here:https://community.se.com/t5/EcoStruxure-Power-Operation/v2021-Release-amp-Updates-Install-Procedure/td-p/358628

EcoStruxure™ Power Monitoring Expert versions prior to 2021 is under limited support and are no longer receiving hotfixes.Customers should consider upgrading and immediately apply the following mitigations to reduce the risk of exploit:• Limit or restrict personnel access to the PME server and workstation locations.• Instruct personnel to lock their Windows desktop after use.Follow the PME security guidelines on securing web communications by reviewing Cybersecurity Recommendations in the user manual.As these products are under limited support, please contact the Schneider Electric Customer Care Center or your local FSR todiscuss upgrade options.

EcoStruxure™ Power Operation versions prior to 2021 is underlimited support and are no longer receiving hotfixes. Customersshould consider upgrading and immediately apply the following mitigations to reduce the risk of exploit:• Limit or restrict personnel access to the EPO server andworkstation locations.• Instruct personnel to lock their Windows desktop after use.Follow the EPO security guidelines on securing web communicationsby reviewing Cybersecurity Recommendations in the user manual.As these products are under limited support, please contact theSchneider Electric Customer Care Center or your local FSR todiscuss upgrade options.


PowerLogic™ HDPM6000

Summary: Original Release

Summary: PowerLogic™ HDPM6000 - SEVD-2023-073-02 PDF Version

Summary: PowerLogic™ HDPM6000 - SEVD-2023-073-02 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its PowerLogic™ HDPM6000 products.
The PowerLogic™ HDPM6000 products are high density, multi-circuit busway and panelboard
power meters.
Failure to apply the mitigation provided below may risk a buffer overflow attack, which could
result in denial of service or remote code execution.

Overview

Schneider Electric

PowerLogic™ HDPM6000

Schneider Electric PowerLogic™ HDPM6000 version 0.58.6 and prior

Schneider Electric PowerLogic™ HDPM6000 version 0.58.7 and before

CVE-2023-28004

A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted
Ethernet request could result in denial of service or remote code execution.

CVE Description

Version 0.58.7 or newer of PowerLogic™ HDPM6000 includes a fix
for this vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/8297113-powerlogichdpm6000/#software-and-firmware


Summary: Original Release

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2023-073-04 PDF Version

Summary: IGSS (Interactive Graphical SCADA System) - SEVD-2023-073-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Data Server, Dashboard and Custom Reports modules for the IGSS (Interactive Graphical SCADA System) product.
The IGSS product is a state-of-the art SCADA system used for monitoring and controlling industrial processes. The Data Server is a module with a TCP interface used by other modules like the Dashboard and the Custom Reports to access data of the SCADA System to be presented.
Failure to apply the remediation provided below may result in Denial of Service and dashboards or report files in the IGSS Report folder being lost, added or changed. Further it may risk remote code execution, which could result in a variety of issues including loss of control of the SCADA System with IGSS running in production mode.

Overview

Schneider Electric

IGSS Data Server

Schneider Electric IGSS Data Server version 16.0.0.23040 and prior

IGSS Dashboard

Schneider Electric IGSS Dashboard version 16.0.0.23040 and prior

Custom Reports

Schneider Electric Custom Reports version 16.0.0.23040 and prior

IGSS Data Server

Schneider Electric IGSS Data Server version 16.0.0.23041

IGSS Dashboard

Schneider Electric IGSS Dashboard version 16.0.0.23041

IGSS Custom Reports

Schneider Electric IGSS Custom Reports version 16.0.0.23041

CVE-2023-27980

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation of a malicious report file in the IGSS project report directory, this could lead to remote code execution when a victim eventually opens the report.

CVE Description

Version 16.0.0.23041 of IGSS Data Server, Dashboard and Custom Reports (RMS) includes corrections and mitigations for these vulnerabilities and is available for download through IGSS Master > Update IGSS Software or here:

CVE-2023-27982

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard files in the IGSS project report directory, when an attacker sends specific crafted messages to the Data Server TCP port, this could lead to remote code execution when a victim eventually opens a malicious dashboard file.

CVE Description

CVE-2023-27978

A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file.

CVE Description

CVE-2023-27981

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code execution when a victim tries to open a malicious report.

CVE Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2023-27984

A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to remote code execution when a user opens a malicious report file planted by an attacker.

CVE Description

CVE-2023-27977

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in the IGSS project report directory, this could lead to loss of data when an attacker sends specific crafted messages to the Data Server TCP port.

CVE Description

CVE-2023-27979

A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in the IGSS project report directory, this could lead to denial of service when an attacker sends specific crafted messages to the Data Server TCP port.

CVE Description

CVE-2023-27983

A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abuses this functionality.

CVE Description


CODESYS Runtime Vulnerabilities

Summary: Original Release

Summary: Updated acknowledgement section

Summary:
A remediation is now available for CVE-2022-4224
for Harmony HMISCU Controller HMISCU,
Modicon Controllers M241 / M251 / M262 and
PacDrive Controllers LMC Eco/Pro/Pro2.

Summary: CODESYS Runtime Vulnerabilit - SEVD-2023-101-01 PDF Version

Summary: CODESYS Runtime Vulnerabilit - SEVD-2023-101-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Note regarding vulnerability details

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Overview

Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS Runtime. Many
vendors, including Schneider Electric, embed CODESYS in their offers. If successfully
exploited, these vulnerabilities could result in a denial of service or, in some cases, in remote
code execution on PacDrive controllers, Modicon Controllers M241 / M251 / M262 / M258 /
LMC058 / M218 and HMISCU products.
Failure to apply the mitigations provided below may risk Logic Integrity and Permissions attacks,
which could result in loss of controllers’ integrity.
January 2024 Update: A remediation is available for CVE-2022-4224 for Harmony HMISCU
Controller, Modicon Controllers M241 / M251 / M262 and PacDrive Controllers LMC
Eco/Pro/Pro2.

Schneider Electric

Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2 All Versions

PacDrive Controller LMC078

Schneider Electric PacDrive Controller LMC078 All Versions

Modicon Controller M241

Schneider Electric Modicon Controller M241 All Versions

Modicon Controller M251

Schneider Electric Modicon Controller M251 All Versions

Modicon Controller M262

Schneider Electric Modicon Controller M262 All Versions

Modicon Controller M258

Schneider Electric Modicon Controller M258 All Versions

Modicon Controller LMC058

Schneider Electric Modicon Controller LMC058 All Versions

Modicon Controller M218

Schneider Electric Modicon Controller M218 All Versions

HMISCU Controller

Schneider Electric HMISCU Controller All Versions

CVE-2022-4224

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause inappropriate access to Sensitive System Files when user management is not configured.

CVE Description

Schneider Electric is establishing a remediation plan for all future versions that will include a fix for these vulnerabilities. We will update this document when the remediations are available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploitation.
• The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242
• Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.
• Enable the optional ‘Implicit Checks’ on logic applications.
• Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs.
• Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.
• Use firewalls to protect and separate the control system network from other networks.
• Use VPN (Virtual Private Networks) tunnels if remote access is required.
• Activate and apply user management and password features.
• Use encrypted communication links.
• Limit the access to both development and control system by physical means, operating system features, etc.
• Protect both development and control system by using up to date malware protection.
To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

Harmony HMISCU Controller Firmware delivered
with Vijeo Designer v6.3.1 includes a fix for CVE-
2022-4224 vulnerability and can be updated through
the Schneider Electric Software Update (SESU)
application.
https://www.se.com/ww/en/product-range/1054-
vijeo-designer-hmi-software/#software-and-firmware
On the engineering workstation, update to v6.3.1 of
Vijeo Designer.
In order to complete the update, connect to Harmony
HMI and download the project file using Vijeo
Designer v6.3.1.

Modicon Controller M241 Firmware delivered with
Machine Expert v2.2 includes a fix for CVE-2022-
4224 vulnerability and can be updated through the
Schneider Electric Software Update (SESU)
application.
https://www.se.com/ww/en/product-range/2226-
ecostruxure-machine-expert-software/
On the engineering workstation, update to v2.2 of
Machine Expert.
Update Modicon Controller M241 to the latest
Firmware and preform reboot.

Modicon Controller M251 Firmware delivered with
Machine Expert v2.2 includes a fix for CVE-2022-
4224 vulnerability and can be updated through the
Schneider Electric Software Update (SESU)
application.
https://www.se.com/ww/en/product-range/2226-
ecostruxure-machine-expert-software/
On the engineering workstation, update to v2.2 of
Machine Expert.
Update Modicon Controller M251 to the latest
Firmware and preform reboot.

Modicon Controller M262 Firmware delivered with
Machine Expert v2.2 includes a fix for CVE-2022-
4224 vulnerability and can be updated through the
Schneider Electric Software Update (SESU)
application.
https://www.se.com/ww/en/product-range/2226-
ecostruxure-machine-expert-software/
On the engineering workstation, update to V2.2 of
Machine Expert.
Update Modicon Controller M262 to the latest
Firmware and preform reboot.

PacDrive3 Controllers LMC Eco/Pro/Pro2 Firmware
delivered with Machine Expert v2.2 includes a fix for
CVE-2022-4224 vulnerability and can be updated
through the Schneider Electric Software Update
(SESU) application.
https://www.se.com/ww/en/product-range/2226-
ecostruxure-machine-expert-software/
On the engineering workstation, update to v2.2 of
Machine Expert.
Update PacDrive 3 Controllers LMC Eco/Pro/Pro2 to
the latest Firmware and preform reboot.

CVE-2023-28355

Improper Validation of Integrity Check Value vulnerability exists that could cause loss of view, modification of view, loss of control, and denial of control when Integrity check fails to identify out-of-band logic changes.

CVE Description

CVE-2022-4046

Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause loss of view, modification of view, loss of control, and denial of control when Integrity check fails to identify out-of-band logic changes.

CVE Description


Summary: Original Release

Summary: Conext™ Gateway/ InsightHome and InsightFacility - SEVD-2023-101-02 PDF Version

Summary: Conext™ Gateway/ InsightHome and InsightFacility - SEVD-2023-101-02 CSAF Version

Public

General Security Recommendations

Note regarding vulnerability details

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Conext™ Gateway/ InsightHome and InsightFacility products.
The InsightHome and InsightFacility products are smart edge devices that connect customers’ Schneider Electric solar and storage systems to the Insight app. InsightHome targets the residential solar and storage market globally. InsightFacility is for large residential and commercial solar and storage systems. Conext™ Gateway was discontinued from 2019 and rebranded as InsightFacility. However, Schneider is still supporting Gateway with firmware fixes.
Failure to apply the remediations provided below may risk remote code execution, which could result in an authenticated user being able to insert a backdoor into the application or could allow the extraction of private certificates.

Overview

Schneider Electric

<=1.16 Build 004

Schneider Electric InsightHome/InsightFacility/Conext™ Gateway (Discontinued in 2019) version 1.16 Build 004 and prior

1.17 Build 079

Schneider Electric InsightHome/InsightFacility/Conext™ Gateway version 1.17 Build 079

CVE-2023-29410

A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the application on the server when a malicious payload is provided over HTTP for the server to execute.

CVE Description

Version 1.17 Build 079 of Conext™ Gateway, InsightHome and InsightFacility includes a fix for this vulnerability and is available for download here:
https://solar.se.com/us/en/product/insighthome-and-insightfacility-edge-devices/#downloads
The installation procedure requires a reboot of the product to complete the update. After successful upgrade, the Insight Local and Insight Cloud Web UI will show latest firmware.


EcoStruxure™ Control Expert

Summary: Original Release

Summary:
A remediation is now available for EcoStruxure™
Control Expert.

Summary: EcoStruxure™ Control Expert - SEVD-2023-101-03 PDF Version

Summary: EcoStruxure™ Control Expert - SEVD-2023-101-03 CSAF Version

Public

General Security Recommendations

Note regarding vulnerability details

Note regarding vulnerability details

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert￼
product.
EcoStruxure™ Control Expert is the common programming, debugging and operating software
for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation
Controllers).
Failure to apply the remediations provided below may risk arbitrary code execution & privilege
escalation which could result in denial of service, loss of confidentiality and integrity of the
software
January 2024 Update: A remediation is available for EcoStruxure™ Control Expert.

Overview

Schneider Electric

EcoStruxure™ Control Expert

Schneider Electric EcoStruxure™ Control Expert <V16.0

Schneider Electric EcoStruxure™ Control Expert V16.0

CVE-2023-27976

A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause
remote code execution when a valid user visits a malicious link provided through the web
endpoints.

CVE Description

• EcoStruxure™ Control Expert V15.3 mitigates the CVE-2023- 27976 by restricting the remote exploitation of this vulnerability. It is available for download below:
https://www.se.com/ww/en/download/document/EcoStruxureCon
trolExpert-V15.3/
• Follow workstation, network and site-hardening guidelines in the
Recommended Cybersecurity Best Practices guide available for
download here.
• To help protect workstations running Schneider Electric and
other user applications against execution of unauthorized
applications and malicious files, Schneider Electric recommends using McAfee Application and Change Control software. Refer to the Cybersecurity Application Note available here.

Version 16.0 of EcoStruxure Control Expert includes fixes for these
vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/548-ecostruxure-controlexpert-
unity-pro/#software-and-firmware

CVE-2023-1548

A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the console server service that is part of EcoStruxure™ Control Expert.

CVE Description


Easy UPS Online Monitoring Software

Summary: Original Release

Summary: The document has been updated to reflect the APC Easy UPS Online Monitoring Software and Schneider Electric Easy UPS Online Monitoring Software remediation is for Windows 10 only. A mitigation for APC Easy UPS Online Monitoring Software and Schneider Electric Easy UPS Online Monitoring Software for Windows 10, 11 Windows Server 2016, 2019, and 2022 has been added.

Summary: A remediation is available that now includes all supported Windows versions.

Summary: Vulnerability description for CVE-2023-29412 has been updated. CWE-78 is correct, but the initial description didn't match with this CWE ID.Remediation instructions were updated to clarify support status.

Summary: Easy UPS Online Monitoring Software - SEVD-2023-101-04 PDF Version

Summary: Easy UPS Online Monitoring Software - SEVD-2023-101-04 CSAF Version

Public

General Security Recommendations

Note regarding vulnerability details

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Overview

Schneider Electric is aware of multiple vulnerabilities in its Easy UPS Online Monitoring Software, known as APC Easy UPS Online Monitoring Software, and Schneider Electric UPS Online Monitoring Software known as Schneider SP Series UPS Online Monitoring Software in China.

The Easy UPS Online Monitoring Software is used to configure and manage Easy UPS products.

Failure to apply the remediations provided below may risk remote code execution, escalation of privileges, or authentication bypass, which could result in execution of malicious web code or loss of device functionality.

June 2024 Update: Vulnerability description for CVE-2023-29412 has been updated. CWE-78 is correct, but the initial description didn’t match with this CWE ID. Remediation instructions were updated to clarify support status.

Schneider Electric

Easy UPS Online Monitoring Software

APC Easy UPS Online Monitoring Software version 2.5-GA-01-22320 and prior installed on Microsoft Windows 10

APC Easy UPS Online Monitoring Software version 2.5-GA-01-22320 and prior installed on Microsoft Windows 11

APC Easy UPS Online Monitoring Software version 2.5-GA-01-22320 and prior installed on Microsoft Windows Server 2016

APC Easy UPS Online Monitoring Software version 2.5-GA-01-22320 and prior installed on Microsoft Windows Server 2019

APC Easy UPS Online Monitoring Software version 2.5-GA-01-22320 and prior installed on Microsoft Windows Server 2022

Schneider Electric Easy UPS Online Monitoring Software version 2.5-GS-01-22320 and prior installed on Microsoft Windows 10

Schneider Electric Easy UPS Online Monitoring Software version 2.5-GS-01-22320 and prior installed on Microsoft Windows 11

Schneider Electric Easy UPS Online Monitoring Software version 2.5-GS-01-22320 and prior installed on Microsoft Windows Server 2016

Schneider Electric Easy UPS Online Monitoring Software version 2.5-GS-01-22320 and prior installed on Microsoft Windows Server 2019

Schneider Electric Easy UPS Online Monitoring Software version 2.5-GS-01-22320 and prior installed on Microsoft Windows Server 2022

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GA-01-23116 installed on Microsoft Windows 10

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GA-01-23116 installed on Microsoft Windows 11

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GA-01-23116 installed on Microsoft Windows Server 2016

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GA-01-23116 installed on Microsoft Windows Server 2019

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GA-01-23116 installed on Microsoft Windows Server 2022

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GS-01-23116 installed on Microsoft Windows 10

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GS-01-23116 installed on Microsoft Windows 11

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GS-01-23116 installed on Microsoft Windows Server 2016

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GS-01-23116 installed on Microsoft Windows Server 2019

Schneider Electric Easy UPS Online Monitoring Software version 2.6-GS-01-23116 installed on Microsoft Windows Server 2022

CVE-2023-29411

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leading to potential remote code execution without requiring prior authentication on the Java RMI interface.

CVE Description

Version v2.6-GA-01-23116 of Schneider Electric Easy UPS Online
Monitoring Software includes a fix for the vulnerabilities for Microsoft
supported versions of Windows (10, 11) and Windows Server (2016,
2019, 2022) and is available for direct download here:
https://download.schneider-electric.com/files?p_enDocType=Software+-
+Release&p_Doc_Ref=APC_install_APC_UPS_windows
The Easy UPS Online Monitoring Software has been discontinued
coinciding with the discontinuation of the Easy UPS Online SNMP Cards
(APV9601, APVS9601) managed by this software.
Note: The fix applies to all variants of UPS Online Monitoring Software.
It is recommended that customers currently using Easy UPS Online
Monitoring Software to manage Easy UPS Online (SRV/SRVS) to
transition to PowerChute Serial Shutdown for serial/USB shutdown and
monitoring; and to PowerChute Network Shutdown for network shutdown
and monitoring. For more information about PowerChute software,
please see the following:
https://www.apc.com/pcss
https://www.apc.com/pcns

Version v2.6-GS-01-23116 of Schneider Electric Easy UPS Online
Monitoring Software includes a fix for the vulnerabilities for Microsoft
supported versions of Windows (10, 11) Windows Server (2016, 2019,
2022) and is available for direct download here:
https://download.schneider-electric.com/files?p_enDocType=Software+-
+Release&p_Doc_Ref=APC_install_APC_UPS_windows
The Easy UPS Online Monitoring Software has been discontinued
coinciding with the discontinuation of the Easy UPS Online SNMP Cards
(APV9601, APVS9601) managed by this software.
Note: The fix applies to all variants of UPS Online Monitoring Software.
It is recommended that customers currently using Easy UPS Online
Monitoring Software to manage Easy UPS Online (SRV/SRVS) to
transition to PowerChute Serial Shutdown for serial/USB shutdown and
monitoring; and to PowerChute Network Shutdown for network shutdown
and monitoring. For more information about PowerChute software,
please see the following:
https://www.apc.com/pcss
https://www.apc.com/pcns

CVE-2023-29412

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when manipulating internal methods through Java RMI interface.

CVE Description

CVE-2023-29413

A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthenticated user on the Schneider UPS Monitor service.

CVE Description