Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities affecting Treck Inc.’s embedded TCP/IP stack, collectively known as Ripple20, which Treck disclosed publicly on June 16. The vulnerabilities range in severity and therefore have varying levels of risk.
Schneider Electric continues to assess how the newly disclosed vulnerabilities affect its offers. The company will continue to update this notification as additional offer-specific information becomes available.
Customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from possible exploitation of these vulnerabilities. Where appropriate, this includes locating their industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the remediation and general security recommendations below.
For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center.
August 2022 Update: Added final mitigations for AVT6000 Medium Voltage Altivar Process Drive (page 2).

Overview

Summary: Treck TCP/IP Vulnerabilities (Ripple20) - SEVD-2020-175-01 PDF Version

Summary: Treck TCP/IP Vulnerabilities (Ripple20) - SEVD-2020-175-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Treck TCP/IP Vulnerabilities (Ripple20)

Summary: Original Release

Summary:
- Added link to related SEVD-2020-174-01 Security Notification document for Network Management Card (NMC) offers (pages 4-5)
- Minor formatting changes

Summary:
- Enhanced Andover Continuum affected product information (page 3)
- Minor formatting changes

Summary: Added Acti9 Smartlink EL B to affected product list (page 2)

Summary: Removed Smartlink ELEC (duplicate reference for Acti9 Smartlink EL B) from the affected product list (page 3)

Summary:
- Added Wiser Energy IP module by Schneider Electric, Wiser Energy IP module by Schneider Electric , and Gateway Connector by Elko to affected products list (page 5)
- Added XUPH001 OsSense communication module and XGCS850C201 OsiSense RFID compact smart antenna to affected products list (page 2)
- Removed PowerLogic EGX100, ECI850 Sepam IEC 61850 Server, and PowerLogic G3200 Modbus to IEC 61850 Gateway from affected products list. (page 3)

Summary: Added remediation for Uninterruptible Power Supply (UPS) using NMC2 (page 2)

Summary: Corrected affected version(s) and enhanced remediation/mitigation version details for Uninterruptible Power Supply (UPS) using NMC2 (page 2)

Summary: Added remediation for Cooling Products using NMC2 and partial remediations for ATM3BC bus coupler module – EIP, TM3BC bus coupler module – SL, and TM3BC bus coupler module – CANOpen (page 2-3)

Summary: Added remediation guidance for VW3A3310 Altivar 61/71 Modbus TCP, VW3A3310D Altivar 61/71 Ethernet daisy chain, VW3A3316 Altivar 61/71 Ethernet IP, and VW3A3320 Altivar 61/71 Ethernet IP RSTP options. (page 2-3)

Summary:
- Added remediation for EGX150/Link150 Ethernet Gateway , Acti9 PowerTag Link / HD , Acti9 Smartlink SI D , and Acti9 Smartlink SI B
- All APC Network Management Card related impact and remediation information has been moved to the existing Security Notification SEVD-2020-174-01 for increased clarity.
- Added PowerLogic EGX100 to affected products list
• Note: Based on information received earlier this year, Schneider Electric originally determined that its PowerLogic EGX100 was not affected by vulnerabilities in Treck Inc.’s embedded TCP/IP stack. After receiving additional information and analysis from Treck, Inc and JSOF, Schneider Electric has determined this offer is impacted. Users of this product are encouraged to apply the recommended mitigation actions immediately to minimize the risks associated with vulnerabilities in Treck Inc.’s embedded TCP/IP stack.

Summary: Added remediations for eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers, IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers, and IFE Gateway (page 4)

Summary: Added remediations for SCADAPack 32 RTU, XUPH001 OsSense communication module, XGCS850C201 OsiSense RFID compact smart antenna, ATV340E Altivar Machine Drives, ATV630/650/660/680/6A0/6B0 Altivar Process Drives, ATV930/950/960/980/9A0/9B0 Altivar Process Drives, VW3A3720, VW3A3721 Altivar Process Communication Modules, ACE850 Sepam communication interface, PowerLogic EGX300 Ethernet Gateway, PowerLogic EGX100 Ethernet Gateway, Acti9 Smartlink IP (page 2, 4-5)

Summary: Added remediations for EcoStruxure Building SmartX IP RP

Summary: Added remediations for PowerLogic PM5000 Series Power Meters in Download Links section (page 11)

Summary: Fixed version for EcoStruxure Building SmartX IP MP Controllers and EcoStruxure Building SmartX IP RP Controllers corrected to 3.02.02 (previously listed as 3.02.01) (page 6)

Summary: Added remediation for Acti9 PowerTag Link C (page 5)

Summary:
Added remediation for ZBRCETH Modbus TCP communication
module for ZBRN1 Harmony Hub (page 4)

Summary: Added remediation for TM3 bus coupler modules – EIP/SL/CANOpen and Acti9 Smartlink EL B A9XELC08 (page 2-3, 5)

Summary: Corrected download links for TM3 bus coupler modules – EIP/SL/CANOpen (page 2-3)

Summary: Added remediation for TeSys T LTMRxxEyy Motor Controllers (page 8)

Summary: Added remediation for Wiser Energy IP module by Schneider Electric (EER31800), Wiser Energy IP module by Clipsal (EER72600), and Gateway Connector by Elko (EKO01827) (page 6-7)

Summary: Added final mitigations for Andover Continuum Controllers (page 6)

Summary: Added final mitigations for AVT6000 Medium Voltage Altivar Process Drive (page 2)

Schneider Electric

ATV340E Altivar Machine Drives

Schneider Electric ATV340E Altivar Machine Drives prior to 3.2IE25

Schneider Electric ATV340E Altivar Machine Drives V3.2IE25

Schneider Electric ATV630/650/660/680/6A0/6B0 Altivar Process Drives prior to 3.3IE33

Schneider Electric ATV630/650/660/680/6A0/6B0 Altivar Process Drives V3.3IE26

ATV630/650/660/680/6A0/6B0 Altivar Process Drives

Schneider Electric ATV930/950/960/980/9A0/9B0 Altivar Process Drives prior to V3.3IE26

Schneider Electric ATV930/950/960/980/9A0/9B0 Altivar Process Drives V3.3IE26

ATV930/950/960/980/9A0/9B0 Altivar Process Drives

Schneider Electric ATV6000 Medium Voltage Altivar Process Drives prior to V1.6IE01

Schneider Electric ATV6000 Medium Voltage Altivar Process Drives Version 3.3IE26 and later

ATV6000 Medium Voltage Altivar Process Drives

SCADAPack 32 RTU

Schneider Electric SCADAPack 32 RTU prior to V2.25

Schneider Electric SCADAPack 32 RTU version 2.25 and later

TM3BC bus coupler module – EIP

Schneider Electric TM3BC bus coupler module – EIP prior to V2.2.1.1

Schneider Electric TM3BC bus coupler module – EIP V2.2.1.1

TM3BC bus coupler module - SL

Schneider Electric TM3BC bus coupler module - SL prior to V2.1.1.1

Schneider Electric TM3BC bus coupler module - SL V2.1.1.1

TM3BC bus coupler module - CANOpen

Schneider Electric TM3BC bus coupler module - CANOpen prior to V2.1.1.1

Schneider Electric TM3BC bus coupler module - CANOpen V2.1.1.1

Schneider Electric VW3A3310 Altivar 61/71 Modbus TCP option version 2.1IE09 and prior

VW3A3310 Altivar 61/71 Modbus TCP option

Schneider Electric VW3A3310D Altivar 61/71 Ethernet daisy chain option Version 3.0IE11 and prior

VW3A3310D Altivar 61/71 Ethernet daisy chain option

Schneider Electric VW3A3320 Altivar 61/71 Ethernet IP option Version V1.2IE14 and prior

VW3A3320 Altivar 61/71 Ethernet IP option

Schneider Electric VW3A3320 Altivar 61/71 Ethernet IP RSTP option version V1.1IE19 and prior

VW3A3320 Altivar 61/71 Ethernet IP RSTP option

XUPH001 OsSense communication module

Schneider Electric XUPH001 OsSense communication module all versions

Schneider Electric XGCS850C201 OsiSense RFID compact smart antenna all versions

XGCS850C201 OsiSense RFID compact smart antenna

Schneider Electric VW3A3720, VW3A3721 Altivar Process Communication Modules All Versions prior to V1.15IE25

Schneider Electric VW3A3720, VW3A3721 Altivar Process Communication Modules version V1.15IE25 and prior

VW3A3720, VW3A3721 Altivar Process Communication Modules

ZBRCETH Modbus TCP communication

Schneider Electric ZBRCETH Modbus TCP communication <=SV:02.04 | <= PV:02 | <=RL:02

Schneider Electric ZBRCETH Modbus TCP communication >=SV:02.05|>=PV:03|>=RL:03

ACE850 Sepam communication interface

Schneider Electric ACE850 Sepam communication interface all versions

Acti9 Smartlink EL B A9XELC08

Schneider Electric Acti9 Smartlink EL B A9XELC08 all versions

Acti9 Smartlink IP

Schneider Electric Acti9 Smartlink IP all versions

Schneider Electric Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D) version V1.7.4 and prior

Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D)

Schneider Electric Acti9 PowerTag Link C (Formerly named Acti9 Smartlink EL D) V6.2

Andover Continuum controller models

Schneider Electric Andover Continuum controller models all versions

NetController 1 (NC1) = Model CX9900
NetController 2 (NC2) = Model CX9680
ACX2 = Model ACX5720 and ACX5740
CX9200 series
CX9400 series
CX9924
CX9702
BCX4040 series
BCX9640 series

Schneider Electric Wiser Energy IP module by Schneider Electric (EER31800) version V1.7.4 and prior

Schneider Electric Wiser Energy IP module by Schneider Electric (EER31800) 6.2

Wiser Energy IP module by Schneider Electric (EER31800)

Schneider Electric Wiser Energy IP module by Clipsal (EER72600) version V1.7.4 and prior

Schneider Electric Wiser Energy IP module by Clipsal (EER72600) 6.2

Wiser Energy IP module by Clipsal (EER72600)

Gateway Connector by Elko (EKO01827)

Schneider Electric Gateway Connector by Elko (EKO01827) version V1.7.4 and prior

Schneider Electric Gateway Connector by Elko (EKO01827) 6.2

Acti9 PowerTag Link / HD

Schneider Electric Acti9 PowerTag Link / HD version prior to 001.008.007

Schneider Electric Acti9 PowerTag Link / HD 7.0

Acti9 Smartlink SI D

Schneider Electric Acti9 Smartlink SI D version prior to 002.004.002

Acti9 Smartlink SI B

Schneider Electric Acti9 Smartlink SI B version prior to 002.004.002

EGX150/Link150 Ethernet Gateway

Schneider Electric EGX150/Link150 Ethernet Gateway version V5.1.15 and prior

Schneider Electric EGX150/Link150 Ethernet Gateway V5.1.18

Schneider Electric eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers Firmware versions prior to V4.001.000

eIFE Ethernet Interface for MasterPact MTZ drawout circuit breakers

Schneider Electric EcoStruxure Building SmartX IP MP Controllers all versions

Schneider Electric EcoStruxure Building SmartX IP MP Controllers versions 3.02.02 and later

EcoStruxure Building SmartX IP MP Controllers

Schneider Electric EcoStruxure Building SmartX IP RP Controllers All versions

Schneider Electric EcoStruxure Building SmartX IP RP Controllers version 3.02.02 and later

EcoStruxure Building SmartX IP RP Controllers

Schneider Electric IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers Firmware versions prior to V4.001.000

IFE Ethernet Interface for ComPact, PowerPact, and MasterPact circuit breakers

IFE Gateway

Schneider Electric IFE Gateway Firmware versions prior to V3.011.003

PowerLogic EGX100 Ethernet Gateway

Schneider Electric PowerLogic EGX100 Ethernet Gateway verison 3.0 and later

PowerLogic EGX300 Ethernet Gateway

Schneider Electric PowerLogic EGX300 Ethernet Gateway all version

PowerLogic PM5000 series power meters

Specified in Download Links section

Schneider Electric PowerLogic PM5000 series power meters Specified in Download Links section

TeSys T LTMRxxEyy Motor Controllers

Schneider Electric TeSys T LTMRxxEyy Motor Controllers version V2.8 and prior

Schneider Electric TeSys T LTMRxxEyy Motor Controllers V2.9

Additional details on these specific vulnerabilities can be found on the ICS-CERT Advisory at https://www.us-cert.gov/ics/advisories/ICSA-20-168-01.

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

The ACE850 ethernet module for SEPAM protection relays is a product designed to be operated on a secure network.
To minimize the risk from both Ripple 20 and the network-accessible functions of the relay we recommend that concerned customers:
- Enable the IP-based filtering capability in the ACE850
- Place strong, active controls on the network hosting the ACE850
- Consider moving to a newer relay such as the Easergy series if product-level access protections are required
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

PowerLogic PM5000 Model,Affected Version,Remediation/Mitigation
"PM5560, PM5563, PM5580",V2.7.8 and earlier,"A fix in V2.8.3 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5560_PM5563_PM5580_V2.8.3_Release.zip&p_Doc_Ref=PM5560_PM5563_PM5580"
PM5561,V10.7.1 and earlier,"A fix in V10.7.3 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5561_upgrade_10.7.3_Release.zip&p_Doc_Ref=PM5561"
PM5650,V2.10.1 and earlier,"A fix in V2.11.2 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5650_upgrade_V2.11.2_Release.zip&p_Doc_Ref=PM5650"
PM5570,V3.1.0 and earlier,"A fix in V3.1.3 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5570_upgrade_V3.1.3_Release.zip&p_Doc_Ref=PM5570"
PM5660,V3.1.1 and earlier,"A fix in V3.1.3 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5660_upgrade_V3.1.3_Release.zip&p_Doc_Ref=PM5660"
PM5760,V3.1.1 and earlier,"A fix in V3.1.3 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5760_upgrade_V3.1.3_Release.zip&p_Doc_Ref=PM5760"
"PM5320, PM5340",V2.1.3 and earlier,"A fix in V2.1.5 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5320_PM5340_v2.1.5_HW_vB1.zip&p_Doc_Ref=PM5320_PM5340"
PM5341,V2.4.1 and earlier,"A fix in V2.4.4 is now available for download:
https://download.schneider-electric.com/files?p_enDocType=Firmware&p_File_Name=PM5341_v2.4.4_HW_vB1.zip&p_Doc_Ref=PM5341"

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

Since the vulnerabilities are present in the TCP/IP stack, an active network connection is required to exploit them. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices.
For devices on a local network:
• Network Partitioning: Locate devices behind firewalls capable of deep packet inspection with rulesets limiting access with only approved protocols and functions and to only those devices and endpoints requiring access.
• Anomalous IP traffic: Block and detect anomalous IP traffic and malformed packets. Refer to the Solution section of the CERT-Coordination Center Vulnerability Note VU#257161 for details.
• Disable DHCP on the NMC and configure it to use a static IP address.
• To avoid the use of DNS, set DNS servers to 0.0.0.0 and utilize static IP addresses for all servers the NMC will connect.
• If DNS must be used, then normalize DNS through a secure recursive server or application layer firewall
• Enable only secure remote access methods. Disable any insecure protocols.
For devices that must communicate via the Internet:
• Minimize network exposure for embedded and critical devices, keeping exposure to the minimum necessary, and ensuring that devices are not accessible from the Internet unless absolutely essential.
If network access is not required:
• Remove the Ethernet cable from the affected device.
Additional mitigations:
• Access Controls: Install physical and logical controls so no unauthorized personnel or device can access your systems, components, peripheral equipment, and networks.
For more details and assistance on how to protect your installation, please contact your local Schneider Electric Industrial Cybersecurity Services organization, which is fully aware of this situation and can support you through the process.

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13

A fix is now available in product releases V3.2IE25 and above.
For product release prior to V3.2IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE33 and above.
For product release prior to V3.3IE33, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V3.3IE26 and above.
For product release prior V3.3IE26, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases V1.6IE01 and above. For product release prior to V1.6IE01, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

Telepace Studio must be used to update the SCADAPack 32 RTU firmware to version 2.25 or newer.
Download and install Telepace Studio 5.4.2 or newer from https://shop.exchange.se.com/en-US/apps/55670

A fix is now available in firmware version V2.2.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_EIP_2_2_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_MBSL_2_1_1_1/

A fix is now available in firmware version V2.1.1.1 available for download below:
https://www.se.com/ww/en/download/document/TM3BC_CO_2_1_1_1/

This is an End Of Commercialization offer that is replaced by the ALTIVAR 900 & ALTIVAR 600 ranges.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This offer is not affected by CVE-2020-11897, CVE-2020-11899, CVE-2020-11900, CVE-2020-11902, CVE-2020-11903, CVE-2020-11905, CVE-2020-11908, CVE-2020-11913.
For other CVEs, the CVSS score is evaluated as Medium in the product context.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

A fix is available in product releases V1.15IE25 and above.
For product release prior V1.15IE25, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for more information.

A fix is now available in product releases
SV:02.05, PV:03, RL:03 and above.
For product release prior to SV:02.05, PV:03, RL:03, apply the mitigations detailed in the Recommended Mitigations section and contact your local technical support for
more information on upgrading to SV:02.05.

This is an End of Commercialization Offer.
If possible, this product should be replaced by PowerTagLink-C (commercial reference A9XELC10 for which a patch is available from version 1.7.5 or greater.
For specific applications not supported by PowerTag Link C (pulse metering, Acti9 RCA, Acti9 iPF+SD 24), apply the mitigation detailed in the Recommended Mitigation section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Smartlink SIB (commercial reference: A9XMZA08) for which a patch is available in FW version 2.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Acti9 PowerTag Link C which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

This is an End of Commercialization offer.
Customers should immediately apply the mitigations detailed in the Recommended Mitigations section below to reduce the risk of exploit.
Customers should also consider upgrading to EcoStruxure Building Operation which is not impacted by this vulnerability.

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Schneider Electric which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Wiser Energy IP module by Clipsal which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Use the Schneider Electric eSetup for Electrician V6.2 mobile app, available below, to download and apply the latest firmware for Gateway Connector by Elko which contains a fix for these vulnerabilities.
Google Play Store for Android devices: https://play.google.com/store/apps/details?id=com.schneiderelectric.ConfigElec
Apple App Store for Apple devices:
https://apps.apple.com/au/app/esetup-for-electrician/id1087855591

Customers should update firmware using EcoStruxure Power Commission (EPC) installer V7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-nodeid=12492093362#/software-firmware-tab

A fix is available in V5.1.18: https://www.se.com/ww/en/product-range-download/63423-link150/?selected-node-id=12366756685 - /software-firmware-tab

The firmware is available through EcoStruxure Power Commission (EPC) software V2.18. The updated version of EPC is available here:
https://www.se.com/ww/en/download/document/Ecoreach_Installer/

All issues remediated in the 3.02.02 release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/ --
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required.

All issues remediated in the 3.02.02
release, and higher. Update files can be found on the Schneider Electric Exchange https://ecoxpert.se.com/
1. Search for ‘relebov3.2.1’
2. Set the Filter criteria to RN or Firmware, as required

This is an End of Commercialization offer.
If possible, this product should be replaced by Link 150 (commercial reference: EGX150) for which a patch is available in FW version 5.1.18 or greater.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

This is an End of Commercialization offer.
If possible, this product should be replaced by Com’X510 (commercial reference: EBX510) which is not impacted by this vulnerability.
To reduce risk of exploitation, apply the mitigations detailed in the Recommended Mitigations section.

Firmware V2.9 of the TeSys T LTMRxxEyy Motor Controllers includes a fix for this vulnerability and is available for download here:
https://download.schneider-electric.com/files?p_Archive_Name=Evo_TeSysT_Pack-13.zip&p_enDocType=Firmware&p_Doc_Ref=Evo_TeSysT_Pack-13