Summary: Original Release

Summary: A remediation is now available for Trio J-Series Ethernet Data Radio on CVE-2023-5629

Summary: Trio™ Licensed and License-free Data Radios - SEVD-2023-346-01 PDF Version

Summary: Trio™ Licensed and License-free Data Radios - SEVD-2023-346-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Trio Licensed and License-Free Data
Radio products.
The Trio Licensed Radio products are designed to provide complete, versatile, and high
availability system solutions for long range wireless data communications in SCADA and remote
telemetry applications. The Trio License-Free Radio products are a range of frequency-hopping
Ethernet and Serial Data Radios operating in the license-free 900Mhz and 2.4 Ghz band and
designed with versatility and flexibility in mind.
Failure to apply the remediations and mitigations provided below may risk disclosure of
information, or potential installation of malicious code.

Overview

Schneider Electric

Trio Q-Series

Schneider Electric Trio Q-Series prior to V2.7.0

Trio Q-Series Ethernet Data Radio

Schneider Electric Trio Q-Series Ethernet Data Radio All Versions

Schneider Electric Trio Q-Series Ethernet Data Radio version 2.7.0

Trio E-Series Ethernet Data Radio

Schneider Electric Trio E-Series Ethernet Data Radio All Versions

Trio J-Series Ethernet Data Radio

Schneider Electric Trio J-Series Ethernet Data Radio All Versions

Schneider Electric Trio J-Series Ethernet Data Radio versions prior to 3.8.3

Schneider Electric Trio J-Series Ethernet Data Radio version 3.8.3

CVE-2023-5629

A CWE-601: URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could
cause disclosure of information through phishing attempts over HTTP

CVE Description

The UK's National Cyber Security Centre (NCSC)

Version 2.7.0 of Trio Q-Series Data Radio firmware
includes a fix for vulnerability CVE-2023-5629 and is
available for download here:
https://www.se.com/us/en/download/document/TrioQFir
mware/
Instructions should be followed from Section 10 Part J –
Firmware Updating and Maintenance in the Trio Q Data
Radio User Manual, available here:
https://download.schneiderelectric.com/files?p_Doc_Ref=Trio+Q+Data+Radio+Use
r+Manual&p_enDocType=User+guide&p_File_Name=Tri
o+Q+Data+Radio+User+Manual.pdf
This section provides information on how to download,
install, and verify the new firmware version.

Version 3.8.3 of Trio J-Series Data Radio firmware
includes a fix for vulnerability CVE-2023-5629 and is
available for download here:
https://www.se.com/us/en/product-range/61420-triolicensefree-radios#software-and-firmware
Instructions should be followed from Section 9 Part I –
Firmware Updating and Maintenance in the Trio J Series
Data Radio User Manual, available here:
https://download.schneiderelectric.com/files?p_Doc_Ref=Trio_JSeries_User_Manual&p_enDocType=User+guide&p_File_Name=Trio+JSeries+Ethernet+Data+Radio+User+Manual.pdf
This section provides information on how to download,
install, and verify the new firmware version.

Customers should only use up to date browsers, to
access the login page for Trio E and Q Series radios.
These browsers automatically prevent “Open
Redirect” HTTP attempts.
Note: Trio E-Series Ethernet Data Radio product has
reached its end of life and is no longer supported.
Note: Schneider Electric is establishing a remediation
plan for all future versions of Trio J-Series Ethernet
Data Radio that will include a fix for this vulnerability.
We will update this document when the remediation is
available.
Customers should immediately apply the above
mitigations to reduce the risk of exploit.

CVE-2023-5630

A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a
privileged user to install an untrusted firmware.

CVE Description

Trio Data Radios should be installed in a secure
location to prevent physical access by unauthorized
personnel, and appropriate password protections put
in place to prevent remote access by unauthorized
personnel.
Firmware loaded in Trio Data Radios should be
confirmed using the hash published with the release
notes and following the instructions in Section 10 Part
J – Firmware Updating and Maintenance in the Trio Q
Data Radio User Manual, available here:
https://download.schneiderelectric.com/files?p_Doc_Ref=Trio+Q+Data+Radio+U
ser+Manual&p_enDocType=User+guide&p_File_Nam
e=Trio+Q+Data+Radio+User+Manual.pdf
This section provides information on how to
download, install, and verify the new firmware


ProLeiT Plant iT/Brewmaxx

Summary: Original Release

Summary: ProLeiT Plant iT/Brewmaxx - SEVD-2023-346-02 PDF Version

Summary: ProLeiT Plant iT/Brewmaxx - SEVD-2023-346-02 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in Redis open-source database, affecting its Plant
iT product.
The Plant iT/Brewmaxx product is an object-oriented and PLC-based process control system
with integrated Manufacturing Execution System functionality. The integrated and modular
software platform consists of basic systems, modules and add-ons that can be flexibly
combined.
Failure to apply the mitigations provided below may risk privilege escalation, which could result
in remote code execution.

Overview

Schneider Electric

Plant iT/Brewmaxx

Schneider Electric Plant iT/Brewmaxx v9.60 and above

CVE-2022-0543

It was discovered, that Redis, a persistent key-value database, due to a packaging issue, is
prone to a Lua sandbox escape, which could result in remote code execution.

CVE Description

Note: The original CVE description from Redis has been modified in the context of Plant iT. Additional details on this specific vulnerability can be found in CVE-2022-0543 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0543

Additional Details

Schneider Electric is establishing a remediation plan for all future
versions of Plant iT that will include a fix for this vulnerability. We will
update this document when the remediation is available. Until then,
customers should immediately apply the following mitigations to
reduce the risk of exploit:
• Install the patch to disable the eval commands in Redis on:
o Application Server
o VisuHub
o Engineering Workstations
o Workstation with emergency mode functionality
• The patch is available via ProLeiT Support:
https://www.proleit.com/support/
• Force usage of secure Redis configuration templates in
system settings as documented in the patch manual.
• Restart all patched Servers and Workstations
To ensure you are informed of all updates, including details on
affected products and remediation plans, subscribe to Schneider
Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp


Easy UPS Online Monitoring Software

Summary: Original Release

Summary: Easy UPS Online Monitoring Software - SEVD-2023-346-03 PDF Version

Summary: Easy UPS Online Monitoring Software - SEVD-2023-346-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Easy UPS Online Monitoring Software, known
as Easy UPS Online Monitoring Software, and Schneider Electric UPS Online Monitoring
Software known as Schneider SP Series UPS Online Monitoring Software in China.
The Easy UPS Online Monitoring Software is used to configure and manage Easy UPS
products.
Failure to apply the remediations provided below may risk elevation of privileges which could
result in arbitrary file deletion with system privileges.

Overview

Schneider Electric Easy UPS Online Monitoring  (Windows 10, 11, Windows Server 2016, 2019, 2022) prior to 2.6-GA-01-23116

Schneider Electric Easy UPS Online Monitoring  (Windows 10, 11, Windows Server 2016, 2019, 2022) 2.6-GA-01-23116

CVE-2023-6407

A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
vulnerability exists that could cause arbitrary file deletion upon service restart when accessed by
a local and low-privileged attacker.

CVE Description

Trend Micro Zero Day Initiative Tenable Network Security

Version 2.6-GA-01-23116 of Easy UPS Online Monitoring Software
includes a fix for the vulnerabilities for Microsoft supported versions
of Windows 10, 11, Windows Server 2016, 2019 & 2022 and is
available for download here:
https://www.apc.com/us/en/faqs/FAQ000260058/
The Easy UPS Online Monitoring Software has been discontinued
coinciding with the discontinuation of the Easy UPS Online SNMP
Cards (APV9601, APVS9601) managed by this software.
It is recommended that customers currently using Easy UPS Online
Monitoring Software to manage Easy UPS Online (SRV/SRVS) to
transition to PowerChute Serial Shutdown for serial/USB shutdown
and monitoring; and to PowerChute Network Shutdown for network
shutdown and monitoring.
For more information about PowerChute software please see the
following:
https://www.apc.com/pcss
https://www.apc.com/pcns


Easergy Studio

Summary: Original Release

Summary: Easergy Studio - SEVD-2024-009-02 PDF Version

Summary: Easergy Studio - SEVD-2024-009-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in our Easergy Studio product.
The Easergy Studio product is a software solution for configuring, monitoring, and managing control devices.
Failure to apply the remediations provided below may risk an attacker with a user level account on the engineering workstation to escalate privileges which could result in an attacker gaining full control of the targeted workstation

Overview

Schneider Electric

Easergy Studio

Schneider Electric Easergy Studio all verisons prior to 9.3.5

CVE-2023-7032

A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain higher privileges by providing a harmful serialized object.

CVE Description

Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam)

Version 9.3.6 of Easergy Studio includes a fix for this vulnerability and is available via SESU (Schneider Electric Software Update) or can be downloaded here:  https://www.se.com/ww/en/product-range/61035-easergy-studio/#software-and-firmware


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert ,
EcoStruxure™ Process Expert and Modicon M340, M580 PLCs (Programmable Logic
Controllers).
Modicon PLCs control and monitor industrial operations. EcoStruxure™ Control Expert is the
common programming, debugging and operating software for Modicon PLCs. EcoStruxure™
Process Expert DCS is a single automation system to engineer, operate, and maintain an entire
plant Infrastructure.
Failure to apply the remediations provided below may risk unauthorized access to your PLC,
which could result in the possibility of denial of service and loss of confidentiality, integrity of the
controller.

Note regarding vulnerability details: The severity of vulnerabilities was calculated using the
CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and
Environmental metrics. Schneider Electric recommends that customers score the CVSS
Environmental metrics, which are specific to end-user organizations, and consider factors such
as the presence of mitigations in that environment. Environmental metrics may refine the
relative severity posed by the vulnerabilities described in this document within a customer’s
environment

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 Safety PLCs - SEVD-2024-044-01 PDF Version

Summary: EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 Safety PLCs - SEVD-2024-044-01 CSAF Version

Summary: Original Release

Summary: Modicon MC80 and Momentum M1E PLCs have been identified as impacted by the CVE-2023-6408. Mitigations are now available

Summary: A remediation is available for the Modicon M580 CPU Safety (page 3).

Summary: Remediation is available for Modicon Momentum controller

Schneider Electric

Modicon M340 CPU (part numbers BMXP34*)

Modicon M340 CPU (part numbers BMXP34*) Versions prior to sv3.60

Modicon M580 CPU (part numbers BMEP* and BMEH* excluding M580 CPU Safety) Versions prior to sv4.20

Modicon M580 CPU Safety

Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions prior to SV4.21

Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Version SV4.21

EcoStruxure™ Control Expert

EcoStruxure™ Control Expert Versions prior to v16.0

EcoStruxure™ Process Expert

EcoStruxure™ Process Expert Versions prior to v2023

Modicon M340 CPU (part numbers BMXP34*)

Modicon M340 CPU (part numbers BMXP34*) SV3.60

Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety)  SV4.20

EcoStruxure™ Control Expert

EcoStruxure™ Control Expert Version 16.0

EcoStruxure™ Process Expert

15.3 HF008

EcoStruxure™ Process Expert Version 15.3 HF008

Modicon MC80 (part numbers BMKC80)

Modicon MC80 (part numbers BMKC80) All Versions

Modicon Momentum Unity M1E Processor Firmware Versions prior to SV2.90 installed on Modicon Momentum Unity M1E Processor Controller

Modicon Momentum Unity M1E Processor Firmware Version SV2.90 installed on Modicon Momentum Unity M1E Processor Controller

A CWE-924: Improper Enforcement of Message Integrity During Transmission in a
Communication Channel vulnerability exists that could cause a denial of service and loss of
confidentiality, integrity of controllers when conducting a Man in the Middle attack.

CVE Description

CVSS v4.0 Base Score 9.2 | Critical | [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

SV3.60 of Modicon M340 firmware includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/1468-
modicon-m340

SV4.20 of Modicon M580 firmware includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/product-range/62098-
modicon-m580-epac/ - software-and-firmware

Version 16.0 of EcoStruxure Control Expert includes a fix
for these vulnerabilities and is available for download
here:
https://www.se.com/ww/en/product-range/548-
ecostruxure-control-expert-unity-pro/
Reboot the computer after installation is completed

Version 15.3 HF008 of EcoStruxure Control Expert
includes the fix for these vulnerabilities and are available
for download here:
https://www.se.com/ww/en/product-range/548-
ecostruxure-control-expert-unity-pro/

Firmware SV4.21 includes a fix for this vulnerability and
is available for download here: https://www.se.com/ww/en/product-range/62098-modicon-m580-pac-controller/#software-andfirmware
Important: customer needs to use version of
EcoStruxure™ Control Expert v16.0 HF001 minimum to
connect with the latest version of M580 CPU Safety. The
software is available for download here:
https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-andfirmware

Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the
user manuals: “Modicon M340 for Ethernet Communications Modules
and Processors User Manual” in chapter “Messaging Configuration
Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/
• Setup a secure communication according to the following guideline
“Modicon Controllers Platform Cyber Security Reference Manual,” in
chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Consider use of external firewall devices such as EAGLE40-07 from
Belden to establish VPN connections for M340 & M580 architectures.
For more details refer to the chapter “How to protect M580 and M340
architectures with EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M340 CPU is running with the memory protection activated
by configuring the input bit to a physical input, for more details refer to
the following guideline “Modicon Controllers Platform Cyber Security
Reference Manual”, “CPU Memory Protection section”:
• https://www.se.com/ww/en/download/document/EIO0000001999/

Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the
user manuals: “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO0000001578/
Setup a secure communication according to the following guideline
“Modicon Controllers Platform Cyber Security Reference Manual,” in
chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• use a BMENOC module and follow the instructions to configure
IPSEC feature as described in the guideline “Modicon M580 -
BMENOC03.1 Ethernet Communications Schneider Electric
Security Notification Module, Installation and Configuration
Guide” in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
OR
• Use a BMENUA0100 module and follow the instructions to configure
IPSEC feature as described in the chapter “Configuring the
BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
OR
• Consider use of external firewall devices such as EAGLE40-07 from
Belden to establish VPN connections for M340 & M580 architectures.
For more details refer to the chapter “How to protect M580 and M340
architectures with EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M580 CPU is running with the memory protection activated
by configuring the input bit to a physical input, for more details refer to
the following guideline “Modicon Controllers Platform Cyber Security
Reference Manual”, “CPU Memory Protection section”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/
NOTE: The CPU memory protection cannot be configured with M580 Hot
Standby CPUs. In such cases, use IPsec encrypted communication.

If customers choose not to apply the remediation then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the
user manuals: “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO0000001578/
• Setup a secure communication according to the following guideline
“Modicon Controllers Platform Cyber Security Reference Manual,” in
chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• use a BMENOC module and follow the instructions to configure
IPSEC feature as described in the guideline “Modicon M580 -
BMENOC03.1 Ethernet Communications Schneider Electric
Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
OR
• Use a BMENUA0100 module and follow the instructions to configure
IPSEC feature as described in the chapter “Configuring the
BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
OR
• Consider use of external firewall devices such as EAGLE40-07 from
Belden to establish VPN connections for M340 & M580 architectures.
For more details refer to the chapter “How to protect M580 and M340
architectures with EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M580 CPU is running with the memory protection activated
by configuring the input bit to a physical input, for more details refer to
the following guideline “Modicon Controllers Platform Cyber Security
Reference Manual”, “CPU Memory Protection section”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/
NOTE: The CPU memory protection cannot be configured with M580
Hot Standby CPUs. In such cases, use IPsec encrypted
communication.
• To further reduce the attack surface on Modicon M580 CPU
Safety:
Ensure the CPU is running in Safety mode and maintenance input is
configured to maintain this Safety mode during operation – refer to
the document Modicon M580 - Safety System Planning Guide - in
the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

Enable encryption on application project and store application files in
secure location with restricted access only for legitimate users.
• Schneider Electric recommends using McAfee Application and Change
Control software for application control. Refer to the Cybersecurity
Application Note available here.
• Follow workstation, network and site-hardening guidelines in the
Recommended Cybersecurity Best Practices available for download
here.

EcoStruxure Process Expert manages application files within its
database in secure way. Do not export & store them outside the
application.
• Schneider Electric recommends using McAfee Application and Change
Control software for application control. Refer to the Cybersecurity
Application Note available here.
• Follow workstation, network and site-hardening guidelines in the
Recommended Cybersecurity Best Practices available for download
here.

Setup an application password in the project properties• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP• Configure the Access Control List following the recommendations of the user manuals:• “Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “Access Control List (ACL)”:https://www.se.com/ww/en/download/document/EIO0000002071/Setup a secure communication according to the following guideline “Modicon Controller Systems Cybersecurity, User Guide” in chapter “Set Up Encrypted Communication”:

Setup an application password in the project properties• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP• Setup a secure communication according to the following guideline “Modicon Controller Systems Cybersecurity, User Guide” in chapter “Set Up Encrypted Communication”:

Firmware SV2.90 includes a fix for this vulnerability and is
available for download here:

https://www.se.com/ww/en/product-range/535-modicon-momentum/

Important: customer needs to use version of EcoStruxure™
Control Expert v16.2 HF003 minimum to connect with the latest
version of Modicon Momentum. The software is available for
download here:

https://www.se.com/ww/en/product-range/548-ecostruxure
control-expert-unity-pro/#software-and-firmware

CVE-2023-6408

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause unauthorized
access to a project file protected with application password when opening the file with
EcoStruxure Control Expert.

CVE Description

CVSS v4.0 Base Score 8.5 | High | [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

Schneider Electric is establishing a remediation plan for all future versions
of EcoStruxure™ Process Expert that will include a fix for this vulnerability.
We will update this document when the remediation is available. Until then,
customers should immediately apply the following mitigations to reduce the
risk of exploit:
• Setup an application password in the project properties
• Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of the
user manuals: “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO0000001578/
• Setup a secure communication according to the following guideline
“Modicon Controllers Platform Cyber Security Reference Manual,” in
chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• use a BMENOC module and follow the instructions to configure
IPSEC feature as described in the guideline “Modicon M580 -
BMENOC03.1 Ethernet Communications Schneider Electric
Security Notification Module, Installation and Configuration Guide” in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
OR
• Use a BMENUA0100 module and follow the instructions to configure
IPSEC feature as described in the chapter “Configuring the
BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
OR
• Consider use of external firewall devices such as EAGLE40-07 from
Belden to establish VPN connections for M340 & M580 architectures.
For more details refer to the chapter “How to protect M580 and M340
architectures with EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M580 CPU is running with the memory protection activated
by configuring the input bit to a physical input, for more details refer to
the following guideline “Modicon Controllers Platform Cyber Security
Reference Manual”, “CPU Memory Protection section”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/
NOTE: The CPU memory protection cannot be configured with M580
Hot Standby CPUs. In such cases, use IPsec encrypted
communication.
• To further reduce the attack surface on Modicon M580 CPU
Safety:
Ensure the CPU is running in Safety mode and maintenance input is
configured to maintain this Safety mode during operation – refer to
the document Modicon M580 - Safety System Planning Guide - in
the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

CVE-2023-6409

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause
unauthorized access to the project file in EcoStruxure™ Control Expert when a local user
tampers with the memory of the engineering workstation.

CVE Description

CVSS v4.0 Base Score 7.2 | High | [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2023-27975


Harmony Relay NFC

Summary: Original Release

Summary: Harmony Relay NFC - SEVD-2024-044-02 PDF Version

Summary: Harmony Relay NFC - SEVD-2024-044-02 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Harmony Relay NFC products.
The Harmony Control Relay and Harmony Timer Relay products are 8A multifunction 3-phase
control and modular timing relays.
Failure to apply the mitigations provided below may risk an authentication bypass attack, which
could result in unauthorized tampering/modification of the device configuration.

Overview

Schneider Electric

Harmony Control Relay

Schneider Electric Harmony Control Relay All versions

Harmony Timer Relay

Schneider Electric Harmony Timer Relay All versions

CVE-2024-0568

CWE-287: Improper Authentication vulnerability exists that could cause unauthorized tampering
of device configuration over NFC communication.

CVE Description

Customers should immediately apply the following mitigations to
reduce the risk of exploit:
Attack is possible only with physical proximity to the relay. Schneider
Electric strongly recommend installing the Harmony Control Relays in
locked cabinet for added security.
To ensure you are informed of all updates, including details on
affected products and remediation plans, subscribe to Schneider
Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.
jsp


EcoStruxure IT Gateway

Summary: Original Release

Summary: EcoStruxure IT Gateway - SEVD-2024-044-03 PDF Version

Summary: EcoStruxure IT Gateway - SEVD-2024-044-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure IT Gateway product.
EcoStruxure IT Gateway product is software that handles communication with your monitored
devices, gathering and sending device data for smart alarm notification.
Failure to apply the remediations provided below may risk local privilege escalation, which could
result in access to the database and compromising data integrity. Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment.

Overview

Schneider Electric

EcoStruxure IT Gateway

Schneider Electric EcoStruxure IT Gateway versions 1.20.x and prior

Schneider Electric EcoStruxure IT Gateway version 1.21

CVE-2024-0865

CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege
escalation when logged in as a non-administrative user

CVE Description

Version 1.21 of EcoStruxure IT Gateway includes a fix for these
vulnerabilities and is available for download here:
• If you have enabled auto updates in EcoStruxure IT, then the
update will be automatically applied.
• If you would like to manually update, follow the instructions
here to upgrade the gateway software to the latest version:
https://community.se.com/t5/Gateway-software-installationand/Updating-EcoStruxure-IT-Gateway-to-the-latestversion/ta-p/447049.
 For further information, see System Requirements
The upgrade process will perform a full remediation. After
performing an upgrade to version 1.21.x or later, there are no
additional steps necessary.
Verify the version of EcoStruxure IT Gateway software is v1.21 or
later.


Easergy T200 Multiple Vulnerabilities

Summary: Original Release

Summary: Easergy T200 Multiple Vulnerabilities - SEVD-2024-072-01 PDF Version

Summary: Easergy T200 Multiple Vulnerabilities - SEVD-2024-072-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Easergy T200 products.
The Easergy T200 RTU Product Line (T200I, T200E, T200P) is a modular platform for medium voltage and low voltage public distribution network management.  Note, this product has been obsoleted since December 31st, 2021, and is no longer available for purchase.
Failure to apply the remediations provided below may allow a brute force attack, which could result in unauthorized data access, and/or compromise of the device.

Overview

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Overview

Schneider Electric

Easergy T200 (Modbus)

<= SC2-04MOD-07000105

Schneider Electric Easergy T200 (Modbus) version SC2-04MOD-07000105 and prior

Easergy T200 (IEC104)

<= SC2-04IEC-07000104

Schneider Electric Easergy T200 (IEC104) version SC2-04IEC-07000104 and prior

Easergy T200 (DNP3)

<= SC2-04DNP-07000104

Schneider Electric Easergy T200 (DNP3) version SC2-04DNP-07000104 and prior

CVE-2024-2051

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that
could cause account takeover and unauthorized access to the system when an attacker
conducts brute-force attacks against the login form.

CVE Description

Easergy T200 has reached its end of life.
There is a fix for this vulnerability and is available by
contacting the Customer Care Center.
Customers could also consider upgrading to the
latest product offering PowerLogic™ T300 to resolve
this issue.

CVE-2024-2050

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
vulnerability exists when an attacker injects then executes arbitrary malicious JavaScript code
within the context of the product.

CVE Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-2052

CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow
unauthenticated files and logs exfiltration and download of files when an attacker modifies the
URL to download to a different location.

CVE Description


EcoStruxure Power Design - Ecodial

Summary: Original Release

Summary: EcoStruxure Power Design - Ecodial - SEVD_2024-072-02 PDF Version

Summary: EcoStruxure Power Design - Ecodial - SEVD_2024-072-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure Power Design - Ecodial product.
The EcoStruxure Power Design - Ecodial product is a software that helps optimize equipment
and costs while managing operating specifications, all along with the design of power
distribution projects.
Failure to apply the provided below may risk deserialization of untrusted data, which could result
in Remote Code Execution

Overview

Schneider Electric

EcoStruxure Power Design - NL

Schneider Electric EcoStruxure Power Design - NL All versions

EcoStruxure Power Design - INT

Schneider Electric EcoStruxure Power Design - INT All versions

EcoStruxure Power Design - FR

Schneider Electric EcoStruxure Power Design - FR All versions

CVE-2024-2229

CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code
execution when a malicious project file is loaded into the application by a valid user

CVE Description

Schneider Electric is establishing a remediation plan for all
future versions of EcoStruxure Power Design - Ecodial that
will include a fix for this vulnerability. We will update this
document when the remediation is available. Until then,
customers should immediately apply the following
mitigations to reduce the risk of exploit:
• Compute hash of the project files and regularly
check the consistency of this hash to verify the
integrity before usage.
• Store the hash information in a separate location
from where the project file is stored.
• When sharing or receiving project files with another
user, the hash information should be provided over
a separate, out of band channel.
• When exchanging files over the network, use
secure communication protocols.
• Only open project files received from a trusted
source.
• Harden the workstation running the application.
• Delete the accounts of people who no longer need
access to the application and the computer running
the application following the principle of least
privilege.
To ensure you are informed of all updates, including details
on affected products and remediation plans, subscribe to
Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp


Easergy Studio

Summary: Original Release

Summary: Easergy Studio - SEVD-2024-100-01 PDF Version

Summary: Easergy Studio - SEVD-2024-100-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Easergy Studio product.
The Easergy Studio product is a software solution for configuring, monitoring, and managing
control devices.
Failure to apply the provided remediation below may risk unquoted search paths, which could
result in escalation of privilege.

Overview

Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment.

Note

Schneider Electric

Easergy Studio

Schneider Electric Easergy Studio v9.3.3 and prior

CVE-2024-2747

CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could
cause privilege escalation when a valid user replaces a trusted file name on the system and
reboots the machine.

CVE Description

Version 9.3.4 and later of Easergy Studio includes a fix for
this vulnerability and is available for download below:
The fix was released in December 2022, and it is
recommended that customers use the latest version
available:
• Easergy_Studio_V9.3.6 Installer_EN | Schneider
Electric


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon M340 and BMXNOE0100 and
BMXNOE0110 products.
The Modicon M340 is a programmable automation controller; BMXNOE0100 and
BMXNOE0110 are network modules used with Modicon M340.
Failure to apply the mitigations provided below may prevent user to update the device firmware
and prevent proper behavior of the webserver. The BMXNOE and Modicon M340 operations
are not impacted by this vulnerability.
August Update: Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon
M340 module) and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0). CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment.

Summary: Modicon M340 and BMXNOE0100 and BMXNOE0110 - SEVD-2024-163-01 PDF Version

Summary: Modicon M340 and BMXNOE0100 and BMXNOE0110 - SEVD-2024-163-01 CSAF Version

Modicon M340, Modbus/TCP Ethernet Modicon M340 module, and Modbus/TCP Ethernet Modicon M340 FactoryCast module

Summary: Original Release

Summary: Remediation is available for Modicon M340

Schneider Electric

Modicon M340

Modicon M340 Firmware Version prior to SV3.70

Modbus/TCP Ethernet Modicon M340 module

Modbus/TCP Ethernet Modicon M340 module Versions prior to SV3.60

Modbus/TCP Ethernet Modicon M340 module Version SV3.60

Modbus/TCP Ethernet Modicon M340 FactoryCast module Versions prior to SV6.80

Modbus/TCP Ethernet Modicon M340 FactoryCast module Version SV6.80

Modicon M340 Firmware versions prior to SV3.70 installed on Modicon Controller M340

Modicon M340 Firmware version SV3.70 installed on Modicon Controller M340

CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may
prevent user to update the device firmware and prevent proper behavior of the webserver when
specific files or directories are removed from the filesystem.

CVE Description

CVSS v4.0 Base Score 6.9 | High | [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N)

CVSS v4.0  Score

Version SV3.60 of BMXNOE0100 includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product/BMXNOE0100/network-module-modicon-m340-modbus-tcp-1-x-rj45-flash-memory-card

Version SV3.70 of Modicon M340 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware

Version SV6.80 of BMXNOE0110 includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product/BMXNOE0110/ethernet-tcp-ip-network-module-modicon-m340-automation-platform-flash-memory-card-internal-ram-16-mb-1-x-rj45-10-100/

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Setup network segmentation and implement a firewall
to block all unauthorized access to FTP port 21/TCP on
the devices.
• FTP service is disabled by default. Deactivate the FTP
service after use when not needed.
• Configure the Access Control List following the
recommendations of the user manuals:
o “Modicon M340 for Ethernet Communications
Modules and Processors User Manual” in
chapter “Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31
007131K01000/

CVE-2024-5056


PowerLogic P5

Summary: Original Release

Summary:
PowerLogic P5 patch was retracted, and
customers should deploy the mitigations provided
below. Also, there was an update to the affected
product version.

Summary:
Remediation for the PowerLogic P5 is now
available

Summary: PowerLogic P5 - SEVD-2024-163-02 PDF Version

Summary: PowerLogic P5 - SEVD-2024-163-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its PowerLogic P5 products.
The PowerLogic P5 is a medium voltage protection relay.
Failure to apply the mitigations provided below may risk denial of service, device reboot, or an
attacker gaining full control of the relay. This could result in loss of protection to your electrical
network. Physical access to the device is required to exploit this issue

Overview

Schneider Electric

PowerLogic P5

Schneider Electric PowerLogic P5 version v01.500.104 and prior

PowerLogic P5 Wave

4.2.3 P5L30

Schneider Electric PowerLogic P5 Wave version V4.2.3 P5L30.

CVE-2024-5559

CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could
cause denial of service, device reboot, or an attacker gaining full control of the relay when a
specially crafted reset token is entered into the front panel of the device.

CVE Description

PowerLogic P5 Wave 4.2.3 P5L30 firmware includes a fix for this vulnerability. Contact Schneider Electric’s Customer Care Center to download this firmware.


EVlink Home Smart

Summary: Original Release

Summary: EVlink Home Smart - SEVD-2024-163-03 PDF Version

Summary: EVlink Home Smart - SEVD-2024-163-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability with the existence of a non-disabled SSH interface
in its EVlink Home Smart charging station.
The EVlink Home Smart charging stations EV charging stations for the residential market.
Failure to follow the remediation and recommendations provided below may risk to expose an
SSH network interface on the local area network of the homeowner, which could result in
increasing the exposure to potential network scanning or reconnaissance activities from
malicious users.

Overview

Schneider Electric

EVlink Home Smart

Schneider Electric EVlink Home Smart version v2.0.4.1.2_131

Schneider Electric EVlink Home Smart version v2.0.3.8.2_128

Schneider Electric EVlink Home Smart version 2.0.5.0.0_134

CVE-2024-5313

CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH
interface over the product network interface. This does not allow to directly exploit the product or
make any unintended operation as the SSH interface access is protected by an authentication
mechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts
to perform a potential denial of service attack on the exposed SSH interface.

CVE Description

Version 2.0.5.0.0_134 of EVlink Home Smart includes a fix
for this vulnerability that has been automatically deployed
since April 19th to all charging stations connected to the
Wiser application.
Make sure the charging station is connected to the Wiser
application to ensure the new version can be downloaded
and installed.
The installed firmware version can be verified through
Wiser application (refer to the settings page for the
charging station).


Summary: Original Release

Summary: SpaceLogic AS-P and AS-B Automation Servers - SEVD-2024-163-04 PDF Version

Summary: SpaceLogic AS-P and AS-B Automation Servers - SEVD-2024-163-04 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its SpaceLogic AS-P and AS-B
products.
The SpaceLogic AS-P system controller performs key functionality: control logic, trend logging &
alarm supervision, and supports communication & connectivity to I/O & field buses.
The Spacelogic AS-B is a compact, all-in-one server or controller for EcoStruxure Building
Operation.
Failure to apply the remediation provided below may risk exposure of SNMP credentials and
escalation of privileges which could cause unauthorized changes to the system configuration.

Overview

Schneider Electric

SpaceLogic AS-P

Schneider Electric SpaceLogic AS-P V5.0.3 and prior

SpaceLogic AS-B

Schneider Electric SpaceLogic AS-B V5.0.3 and prior

SpaceLogic AS-P

Schneider Electric SpaceLogic AS-P version 6.0.1

SpaceLogic AS-B

Schneider Electric SpaceLogic AS-B version 6.0.1

CVE-2024-5558

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could
cause escalation of privileges when an attacker abuses a limited admin account.

CVE Description

Version 6.0.1 or greater of SpaceLogic AS-P and AS-B
includes a fix for this vulnerability and is available for
download here: https://ecoxpert.se.com/en/softwarecenter/
building-automation/ebo-system/building-operation-
2024-version-6.0
Hotfix patches are also available for versions 5.0.3 and
4.0.5 here: https://community.se.com/t5/EBO-Hotfix-List/bgp/
sbo-hotfix-list
Step1: Locate the version you need to patch on the
Exchange Community using the links above.
Step 2: Follow the instructions in the readme file.

CVE-2024-5557

CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause
exposure of SNMP credentials when an attacker has access to the controller logs.

CVE Description


SAGE RTU

Summary: Original Release

Summary: Mitigations were provided to address this vulnerability. Also, there was an update to the affected product version.

Summary: A direct link is now available to the remediation.

Summary: SAGE RTU - SEVD-2024-163-05 PDF Version

Summary: SAGE RTU - SEVD-2024-163-05 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its SAGE RTU products.
The SAGE RTU products are hardware devices that collect utility substation information from
different devices and passes it along to a SCADA software platform.
Failure to apply the remediation provided below may risk total compromise of the impacted
device, leading to loss of data, loss of operation, or impacts to the performance of the device.

Overview

Schneider Electric

Sage 1410

Schneider Electric Sage 1410 Versions C3414-500-S02K5_P8 and prior

Sage 1430

Schneider Electric Sage 1430 Versions C3414-500-S02K5_P8 and prior

Sage 1450

Schneider Electric Sage 1450 Versions C3414-500-S02K5_P8 and prior

Sage 2400

Schneider Electric Sage 2400 Versions C3414-500-S02K5_P8 and prior

Sage 3030 Magnum

Schneider Electric Sage 3030 Magnum Versions C3414-500-S02K5_P8 and prior

Sage 4400

Schneider Electric Sage 4400 Versions C3414-500-S02K5_P8 and prior

Sage 1410

Schneider Electric Sage 1410 C3414-500-S02K5_P9

Sage 1430

Schneider Electric Sage 1430 C3414-500-S02K5_P9

Sage 1450

Schneider Electric Sage 1450 C3414-500-S02K5_P9

Sage 2400

Schneider Electric Sage 2400 C3414-500-S02K5_P9

Sage 3030 Magnum

Schneider Electric Sage 3030 Magnum C3414-500-S02K5_P9

Sage 4400

Schneider Electric Sage 4400 C3414-500-S02K5_P9

CVE-2024-37036

CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass
when sending a malformed POST request and particular configuration parameters are set.

CVE Description

Firmware version C3414-500-S02K5_P9 of SAGE RTU includes a fix for these vulnerabilities and is available for download here:https://www.se.com/us/en/download/document/C3414-500-S02K5_P9_Firmware/

CVE-2024-37037

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path
Traversal’) vulnerability exists that could allow an authenticated user with access to the device’s
web interface to corrupt files and impact device functionality when sending a crafted HTTP
request.

CVE Description

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated
user with access to the device’s web interface to perform unauthorized file and firmware
uploads when crafting custom web requests.

CVE Description

CVE-2024-37039

CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the
device when an attacker sends a specially crafted HTTP request.

CVE Description

CVE-2024-37040

CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.

CVE Description

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVE-2024-5560

CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the
device’s web interface when an attacker sends a specially crafted HTTP request.

CVE Description


Wiser Home Controller WHC-5918A

Summary: Original Release

Summary: Wiser Home Controller WHC-5918A - SEVD-2024-191-01 PDF Version

Summary: Wiser Home Controller WHC-5918A - SEVD-2024-191-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Wiser Home Controller WHC-5918A product.
The Wiser Home Controller WHC-5918A, a C-Bus based home automation controller, was
discontinued on December 31, 2015.
Failure to apply the mitigations provided below may risk credentials being stolen, which could
result in the Wiser Home Controller WHC-5918A being compromised.

Overview

Schneider Electric

Wiser Home Controller WHC-5918A

Schneider Electric Wiser Home Controller WHC-5918A All Versions

CVE-2024-6407

CWE-200: Information Exposure vulnerability exists that could cause disclosure of
credentials when a specially crafted message is sent to the device.

CVE Description

Exposure of Sensitive Information to an Unauthorized Actor

The Wiser Home Controller WHC-5918A product has been
discontinued and is out of support. Customers should consider
upgrading to the latest product offering, C-Bus, Home Controller,
SpaceLogic IP, Free Standing, 24V DC, 5200WHC2, or removing
the Wiser Home Controller WHC-5918A from service.


Summary: Original Release

Summary: EcoStruxureTM Foxboro DCS Core Control Services - SEVD-2024-191-02 PDF Version

Summary: EcoStruxureTM Foxboro DCS Core Control Services - SEVD-2024-191-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxureTM Foxboro DCS product.
The EcoStruxureTM Foxboro DCS product is an innovative family of fault-tolerant, highly
available control components, which consolidates critical information and elevates staff
capabilities to ensure flawless, continuous plant operation.
Failure to apply the remediations provided below may risk local attacks from an authenticated
user on the workstation running Foxboro DCS Core Control Services, which could result in loss
of system functionality or unauthorized access to system functions.

Overview

Schneider Electric

Schneider Electric EcoStruxureTM Foxboro DCS Core Control Services version 9.8 and prior

v9.5 to v9.8

Schneider Electric EcoStruxureTM Foxboro DCS Core Control Services version from v9.5 to v9.8

Schneider Electric EcoStruxureTM Foxboro DCS Core Control Services version HF97872598

CVE-2024-5679

CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or
kernel memory leak when a malicious actor with local user access crafts a script/program using
an IOCTL call in the Foxboro.sys driver.

CVE Description

Patch HF97872598 available for v9.5 to v9.8 of EcoStruxureTM
Foxboro DCS Core Control Services includes a fix for these
vulnerabilities.
Please contact your local Service Representative or Schneider
Electric Process Automation Global Customer Support Center for
information on how to download and install this fix:

As the identified vulnerabilities require local user account access,
EcoStruxureTM Foxboro DCS workstations should be installed in a
secure location to prevent physical access by unauthorized
personnel, and appropriate password protections put in place to
prevent remote access by unauthorized personnel.
To ensure you are informed of all updates, including details on
affected products and remediation plans, subscribe to Schneider
Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.
jsp

CVE-2024-5680

CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denialof-
service when a malicious actor with local user access crafts a script/program using an IOCTL
call in the Foxboro.sys driver.

CVE Description

CVE-2024-5681

CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service,
privilege escalation, and potentially kernel execution when a malicious actor with local user
access crafts a script/program using an IOCTL call in the Foxboro.sys driver.

CVE Description


Summary: Original Release

Summary: EcoStruxure Foxboro SCADA FoxRTU Station - SEVD-2024-191-03 PDF Version

Summary: EcoStruxure Foxboro SCADA FoxRTU Station - SEVD-2024-191-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Foxboro SCADA FoxRTU
Station product.
FoxRTU Station software facilitates configuration, diagnostics, logic development and device
management for the SCD2200. The EcoStruxure™ Foxboro SCADA SCD2200 product is a
modular Remote Terminal Unit (RTU) for remote SCADA applications.
Failure to apply the remediations provided below may risk remote code execution, which could
result in denial-of-service or unauthorized access to system functions.

Overview

Schneider Electric

FoxRTU Station

Schneider Electric FoxRTU Station prior to v9.3.0

Schneider Electric FoxRTU Station v9.3.0

CVE-2024-2602

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path
Traversal') vulnerability exists that could result in remote code execution when an authenticated
user executes a saved project file that has been tampered by a malicious actor.

CVE Description

Anooja Joy, Sushant Mane and Dr. Faruk Kazi

Version 9.3.0 of FoxRTU Station includes a fix for this vulnerability.
Please contact your local Service Representative or Schneider
Electric Process Automation Global Customer Support Center for
information on how to download and install this fix:
Process Automation | Global Customer Support (se.com)
Please follow the instructions in Chapter 12 of User Guide B0780AE
rev. P, “Security: Securing a Project” to encrypt and password
protect project files.

As the identified vulnerability requires file write access on
the machine on which FoxRTU Station is installed, proper
file system access control restrictions should be
implemented to prevent unauthorized users from editing
FoxRTU Station project files or placing malicious DLLs in
accessible directories.
• Store the project files in a secure storage and restrict the
access to only trusted users
• When exchanging files over the network, use secure
communication protocols
• Encrypt project files when stored
• Only open project files received from trusted source
• Compute a hash of the project files and regularly check
the consistency of this hash to verify the integrity before
usage
• Follow workstation, network and site-hardening
guidelines in the Recommended Cybersecurity Best
Practices available here:
https://www.se.com/us/en/download/document/7EN52-
0390/
• To ensure you are informed of all updates, including
details on affected products and remediation plans,
subscribe to Schneider Electric’s security notification
service here:
https://www.se.com/en/work/support/cybersecurity/securit
y-notifications.jsp


Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, M258 / LMC058 and M262 product(s).
The Modicon Controllers M241 / M251 / M258 / M262  and Modicon Motion Controller LMC058 Programmable Logic Controllers for performance-demanding applications.  Failure to apply the remediation provided below may risk a Cross Site Scripting or an open redirect attack which could result in an account takeover scenario or the execution of code in the user browser.October 2025 Update: A remediation is now available for Modicon Controllers M258 / LMC058

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

Summary: Modicon Controllers M241/ M251, M258 / LMC058 and M262  - SEVD-2024-191-04 PDF Version

Summary: Modicon Controllers M241/ M251, M258 / LMC058 and M262  - SEVD-2024-191-04 CSAF Version

Summary: Original Release

Summary: A remediation is now available for Modicon Controllers M262 and M241 / M251.

Summary: A remediation is now available for Modicon Controllers M258 / LMC058.

Schneider Electric

Modicon Controllers M241

Schneider Electric Modicon Controllers M241 Version prior to v5.2.11.24

Schneider Electric Modicon Controllers M241 Version v5.2.11.24

Modicon Controllers M258

Modicon Controllers M258 Versions prior to v5.0.4.19

Modicon Controllers LMC058

Modicon Controllers LMC058 Versions prior to v5.0.4.19

Modicon Controllers M262

Schneider Electric Modicon Controllers M262 Versions prior to v5.2.8.26

Schneider Electric Modicon Controllers M262 Versions v5.2.8.26

Modicon Controllers M251

Schneider Electric Modicon Controllers M251 Version prior to v5.2.11.24

Schneider Electric Modicon Controllers M251 Version v5.2.11.24

Schneider Electric Modicon Controllers M241 Version 5.2.11.24 installed on Modicon Controllers M241

Schneider Electric Modicon Controllers M251 Version 5.2.11.24 installed on Modicon Controllers M251

Modicon Controllers M258 Version 5.0.4.19 installed on Modicon Controllers M258

Modicon Controllers LMC058 Version 5.0.4.19 installed on Modicon Controllers LMC058

Schneider Electric Modicon Controllers M262 Version 5.2.8.26 installed on Modicon Controllers M262

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.

CVE Description

Modicon Controller M241 Firmware version 5.2.11.24
delivered with EcoStruxure™ Machine Expert v2.2.2
includes a fix for this vulnerability and can be updated
through the Schneider Electric Software Update (SESU)
application.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
On the engineering workstation, update to v2.2.2 of
EcoStruxure™ Machine Expert.
Update Modicon Controller M241 to the latest Firmware and
perform reboot

Modicon Controller M251 Firmware version 5.2.11.24
delivered with EcoStruxure™ Machine Expert v2.2.2
includes a fix for this vulnerability and can be updated
through the Schneider Electric Software Update (SESU)
application.
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
 On the engineering workstation, update to v2.2.2 of
EcoStruxure™ Machine Expert.
Update Modicon Controller M251 to the latest Firmware and
perform reboot

Modicon Controller M262 Firmware version 5.2.8.26
 delivered with EcoStruxure™ Machine Expert v2.2.2
includes a fix for this vulnerability and can be updated
through the Schneider Electric Software Update (SESU)
application.https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/
On the engineering workstation, update to v2.2.2 of
EcoStruxure™ Machine Expert.
Update Modicon Controller M262 to the latest Firmware
and perform reboot

Modicon M258/LMC058 Firmware version 5.0.4.19 includes a fix for this vulnerability and can be downloaded here: https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware
By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Customers should immediately apply the following mitigations to reduce the risk of exploit:

Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from public internet or untrusted networks.

Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.

Deactivate the Webserver after use when not needed.

Use encrypted communication links.

Setup network segmentation and implement a firewall to block all unauthorized access to port 80/HTTP and 443/HTTPS.

Use VPN (Virtual Private Networks) tunnels if remote access is required.

The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide product specific chapters

To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here

CVE-2024-6528


Accutech Manager

Summary: Original Release

Summary: Accutech Manager - SEVD-2024-226-01 PDF Version

Summary: Accutech Manager - SEVD-2024-226-01 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Accutech Manager software.
The Accutech Manager software is the configuration and monitoring application for Accutech
Wireless sensor devices.
Failure to apply the remediations provided below may risk in remote attacks from an
unauthenticated user, which could result in resource exhaustion and loss of availability of the
software.

Overview

Schneider Electric

Accutech Manager

Schneider Electric Accutech Manager Version 2.08.01 and prior

Schneider Electric Accutech Manager version v2.10.0

CVE-2024-6918

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability
exists that could cause a crash of the Accutech Manager when receiving a specially crafted
request over port 2536/TCP.

CVE Description

Version 2.10.0 of Accutech Manager includes a fix for this
vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/Accutech_Manager/
Instructions are provided with the software installation package on
how to verify software revision.


Summary: Original Release

Summary: EcoStruxure™ Machine SCADA Expert / BLUE Open Studio - SEVD-2024-226-02 PDF Version

Summary: EcoStruxure™ Machine SCADA Expert / BLUE Open Studio - SEVD-2024-226-02 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability disclosed on AVEVA component used in
EcoStruxure™ Machine SCADA Expert and BLUE Open Studio products.
The EcoStruxure™ Machine SCADA Expert is software for developing HMI, SCADA, OEE and
Dashboard projects dedicated to Line Management & Lite Supervision applications to run in
Harmony Industrial PC and GTU Open Box.
Pro-face BLUE Open Studio is a development and runtime software that incorporates tools
users need to create SCADA HMI applications, dashboards, and OEE interfaces.
Failure to apply the remediation provided below may risk privilege escalation and/or Arbitrary
code execution which could result in information disclosure, integrity loss or denial of service.

Overview

Vulnerability disclosed by AVEVA Group Limited in its component impacts Schneider Electric
software. Additional information about the vulnerabilities can be found in the AVEVA Advisories
at:
AVEVA Security Advisory (AVEVA -2024-002) - https://www.aveva.com/content/dam/aveva/documents/support/cyber-security-updates/Security_Bulletin_AVEVA-2024-002.pdf

Vulnerability Details

Schneider Electric

EcoStruxure™ Machine SCADA Expert

<2020 SP3 HF1

Schneider Electric EcoStruxure™ Machine SCADA Expert Version prior to 2020 SP3 HF1

EcoStruxure™ Machine SCADA Expert

2020 SP3 HF1

Schneider Electric EcoStruxure™ Machine SCADA Expert Version 2020 SP3 HF1

BLUE Open Studio

<2020 SP3 HF1

Schneider Electric BLUE Open Studio Version prior to 2020 SP3 HF1

BLUE Open Studio

2020 SP3 HF1

Schneider Electric BLUE Open Studio Version 2020 SP3 HF1

CVE-2023-6132

The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve
arbitrary code execution and privilege escalation by manipulating AVEVA Edge to load an unsafe DLL. Vulnerability disclosed by AVEVA Group Limited in its component impacts Schneider Electric
software. Additional information about the vulnerabilities can be found in the AVEVA Advisories
at:
AVEVA Security Advisory (AVEVA -2024-002)

CVE Description

Version 2023 release or later of EcoStruxure™ Machine
SCADA Expert includes a fix for this vulnerability and is
available for download https://www.se.com/ww/en/productrange/
63734-ecostruxure-machine-scadaexpert/#
software-and-firmware.
Version 2020 SP3 HF1 release of EcoStruxure™ Machine
SCADA Expert includes a fix for this vulnerability. Please
contact your Schneider Electric Customer Care Center to
obtain the Hot Fix.
For additional details please refer to the supplied help file in
Hot Fix 2020 SP3 HF1.

Version 2023 release or later of BLUE Open Studio includes
a fix for this vulnerability and is available for download
https://www.proface.com/en/news/2023/1117_1.
Version 2020 SP3 HF1 release of BLUE Open Studio
includes a fix for this vulnerability. Please contact your Proface
Customer Care Center to obtain the Hot Fix.
For additional details please refer to the supplied help file in
Hot Fix 2020 SP3 HF1.