Wind River VxWorks Vulnerabilities (URGENT/11)

Summary: Original Release

Summary:
Added Modicon LMC078 Controller to list of affected products, and removed a
duplicate product.

Summary: Added SAGE RTU to list of affected products.

Summary:
Removed Modicon M580 Ethernet / Serial RTU Module and added Modicon eX80 -
BMEAHI0812 HART Analog Input Module to list of affected products.

Summary: Updated affected versions for Easergy MiCOM C264 product.

Summary:
- Exploit information added to Overview Section
- Remediations added for SAGE RTU, Easergy MiCOM C264, and SCADAPack
57x RTUs
- Updated affected versions for Easergy MiCOM P40

Summary:
Updated affected versions for SCADAPack 57x RTUs and SAGE RTU under
Available Remediations.

Summary:
Updated remediations for ConneXium Industrial Firewall, Easergy MiCOM C264
Controller (page 2-3)
Enhanced product list with additional details for Modicon X80 I/O modules. Added
Modicon Quantum Head 140 CRP, Modicon Momentum Unity, and removed
TMSES4 Ethernet Module from affected products.

Summary: Updated remediations for Modicon M262 Logic/Motion Controller (page 3)

Summary:
Updated remediations for Modicon M580 Ethernet Communications Modules,
Modicon M580 ePAC CPUs including Safety CPUs, Easergy P5, ION7400,
ION9000, PM8000.

Summary:
Updated remediations for Modicon X80 I/O modules, Modicon Momentum Unity,
Nanodac Recorder / Controller (added to affected products), SCADAPack 53xE
RTUs, and Saitel DR with HU_A CPU.

Summary:
Updated remediations for Modicon LMC078 Controller, Modicon M580 Ethernet
communications Modules: Modicon M580 IEC 61850 - BMENOP0300 (C), Modicon
MC80 Programmable Logic Controller, Modicon Quantum 140 NOP
Communications Module, PacDrive 3 Eco/Pro/Pro2 Motion Controllers, Pro-face HMI -GP4000H/R/E Series, GP4100 Compact Series, LT4000M Modular Series,
GP4000E Series, IoT Gateway, SP5000 Series, and SP5000X Series, Easergy
MiCOM Px40, and TeSys island.

Summary:
Updated remediations for HMIGXU, Easergy MiCOM P30, Tricon Communication
Modules, Trident Communication Integration Module.

Summary: Updated remediations for ION7400 MID and PM8000 MID.

Summary:
Updated remediations for Modicon Network Option Switch, Modicon X80 - I/O Drop
Adapters, Modicon Quantum 140 CRA, Modicon Quantum Head 140 CRP, and
Modicon Quantum Ethernet DIO network module - 140NOC78x00 (C), SCD6000
Industrial RTU, Pro-face HMI -GP4000H/R/E Series.

Summary:
Clarified “Affected Version” and “Remediation” version reference numbers for
SCD6000 Industrial RTU product.

Summary:
Updated remediations for Easergy T300 and Magelis HMI - HMIGTO Series,
HMISCU Series, HMIGTUX Series, and HMIGTU Series (Except Open BOX)
products.

Summary:
Updated remediations for versadac™ Scalable Data Recorder, E+PLC100
Combination PLC, and E+PLC400 Combination PLC products.

Summary:
Updated remediations for Modicon M241 Micro PLC and Modicon M251 Micro
PLC.

Summary: Wind River VxWorks Vulnerabilities (URGENT/11) - SESB-2019-214-01 PDF Version

Summary: Wind River VxWorks Vulnerabilities (URGENT/11) - SESB-2019-214-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Wind River's VxWorks TCP/IP Stack vulnerabilities have wide-ranging impact across multiple IT and
industrial applications. We are working closely with Wind River to understand and assess how these
vulnerabilities impact Schneider Electric offers and our customers’ operations. We downloaded Wind
River’s patches as soon as they were made available to us, and we have quickly instituted a
remediation plan to evolve all current and future products that rely on the Wind River platform to
embed these fixes.
We will continue to monitor and will respond further if new information becomes available. In the
meantime, customers should immediately make sure they have implemented cybersecurity best
practices across their operations to protect themselves from these vulnerabilities. Where appropriate
this includes locating your industrial systems and remotely accessible devices behind firewalls;
installing physical controls to prevent unauthorized access; and preventing mission-critical systems
and devices from being accessed from outside networks.
Please subscribe to the Schneider Electric security notification service to be informed of updates to
this disclosure, including details on affected products and remediations, as well as other important
security notifications:
https://www.schneider-electric.com/en/work/support/cybersecurity/security-notifications.jsp
For additional information and support, please contact your Schneider Electric sales or service
representative or Schneider Electric’s Customer Care Center.
Note: Schneider Electric is aware of a potential exploit available that targets the URGENT/11
vulnerabilities. Our customers should urgently consider applying the remediations or mitigations
detailed in this document.
September 2022 Update: CANopen X80 Communication Module (BMECXM0100) (page 2) and
Profibus Remote Master (TCSEGPA23F14F) (page 7) added to the list of affected products, along
with their final mitigations.

Overview

Additional details on these specific vulnerabilities can be found on the Wind River security notification
webpage:
https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
Of the 11 identified Wind River vulnerabilities, six have the potential to trigger remote code execution.
Four of those six can be mitigated by a specific firewall configuration, even if access to the device is
required. The other vulnerabilities can trigger denial of service conditions or information disclosure.
Important to note, not all vulnerabilities apply to all impacted versions.

Details

Schneider Electric

CANopen X80 Communication Module (BMECXM0100)

Schneider Electric CANopen X80 Communication Module (BMECXM0100) All versions

ConneXium Industrial Firewall/Router

Schneider Electric ConneXium Industrial Firewall/Router - TCSEFEC2CF3F21(MM/TX) - TCSEFEC23FCF21 (TX/MM) -  TCSEFEC23F3F21 (TX/TX) V5.33 and prior

ConneXium Industrial Firewall

Schneider Electric ConneXium Industrial Firewall- TCSEFEC2CF3F20 (MM/TX) - TCSEFEC23FCF20 (TX/MM)- TCSEFEC23F3F20 (TX/TX) version 5.24 and prior

E+PLC100 Combination PLC

Schneider Electric E+PLC100 Combination PLC firmware V1.2.0.4 and prior

E+PLC400 Combination PLC

Schneider Electric E+PLC400 Combination PLC firmware V1.2.0.4 and prior

HMIGXU

Schneider Electric HMIGXU V1.1.0.32 and prior

Magelis HMI

HMIGTO Series

Schneider Electric Magelis HMI HMIGTO Series

HMISCU Series

Schneider Electric Magelis HMI HMISCU Series

HMIGTUX Series

Schneider Electric Magelis HMI HMIGTUX Series

HMIGTU Series

Schneider Electric Magelis HMI HMIGTU Series

HMIGTU Series - Open Box

Schneider Electric Magelis HMI HMIGTU Series - Open Box

Vijeo Designer

<=6.2 SP9

Schneider Electric Vijeo Designer V6.2 SP9 and prior

Modicon X80 I/O modules: - Modicon X80 BMEAHI0812 HART Analog Input Module

Schneider Electric Modicon X80 I/O modules: - Modicon X80 BMEAHI0812 HART Analog Input Module V1.30 and prior

Modicon X80 I/O modules: - Modicon X80 BMEAHO0412 HART Analog Output Module

Schneider Electric Modicon X80 I/O modules: - Modicon X80 BMEAHO0412 HART Analog Output Module V1.30 and prior

Modicon X80 I/O modules: - Modicon Network Option Switch BMENOS0300 (C)

Schneider Electric Modicon X80 I/O modules: - Modicon Network Option Switch BMENOS0300 (C) V1.01 and prior

Modicon X80 I/O modules: - I/O Drop Adapters - BMXCRA31200, BMXCRA31210 (C), BMECRA31210 (C)

Schneider Electric Modicon X80 I/O modules: - I/O Drop Adapters - BMXCRA31200 V2.40 and prior

Schneider Electric Modicon X80 I/O modules: - I/O Drop Adapters - BMXCRA31210 (C) V2.40 and prior

Schneider Electric Modicon X80 I/O modules: - I/O Drop Adapters - BMECRA31210 (C) V2.40 and prior

Modicon LMC078 Controller

Schneider Electric Modicon LMC078 Controller  V1.51.15.05 and prior

Modicon M241 Micro PLC

Schneider Electric Modicon M241 Micro PLC Firmware versions prior to V5.1.9.14

Modicon M251 Micro PLC

Schneider Electric Modicon M251 Micro PLC Firmware versions prior to V5.1.9.14

Modicon M262 Logic/Motion Controller

Schneider Electric Modicon M262 Logic/Motion Controller Firmware V5.0.3.2 and prior

Modicon M580 Ethernet Communications Modules: BMENOC0301

Schneider Electric Modicon M580 Ethernet Communications Modules: BMENOC0301

Modicon M580 Ethernet Communications Modules: BMENOC0311

Schneider Electric Modicon M580 Ethernet Communications Modules: BMENOC0311

Modicon M580 Ethernet Communications Modules: BMENOC0321

Schneider Electric Modicon M580 Ethernet Communications Modules: BMENOC0321

Modicon M580 Ethernet communications Modules Modicon M580 IEC 61850 - BMENOP0300 (C)

Schneider Electric Modicon M580 Ethernet communications Modules Modicon M580 IEC 61850 - BMENOP0300 (C) V2.1 and prior

Modicon M580 ePAC CPUs including Safety CPUs

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP584040 V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEH584040 and C V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP586040 and C V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEH586040 and C V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP581020 and H V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP582020 and H V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP582040 and H V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP583020 V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP583040 V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP584020 V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP585040 and C V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEH582040 and C V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP584040S V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEH584040S V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEH586040S V2.90 and prior

Schneider Electric Modicon M580 ePAC CPUs including Safety CPUs BMEP582040S V2.90 and prior

Modicon MC80 Programmable Logic Controller

Schneider Electric Modicon MC80 Programmable Logic Controller V1.4 and prior

Modicon Momentum Unity

Schneider Electric Modicon Momentum Unity V2.01 and prior

Modicon Quantum Ethernet DIO network module - 140NOC78x00 (C)

Schneider Electric Modicon Quantum Ethernet DIO network module - 140NOC78x00 (C) All versions

Modicon Quantum 140 CRA - 140CRA31200, 140CRA31908

Schneider Electric Modicon Quantum 140CRA31200 V2.40 and prior

Schneider Electric Modicon Quantum 140CRA31908 V2.40 and prior

Modicon Quantum Head 140 CRP module - 140CRP31200 (C)

Schneider Electric Modicon Quantum Head 140 CRP module - 140CRP31200 (C) All versions

Modicon Quantum 140 NOP Communications Module

Schneider Electric Modicon Quantum 140 NOP Communications Module All versions

Nanodac Recorder / Controller

Schneider Electric Nanodac Recorder / Controller V8.14 and prior

PacDrive 3 Eco/Pro/Pro2 Motion Controllers

Schneider Electric PacDrive 3 Eco/Pro/Pro2 Motion Controllers  V1.62.5.6 and prior

Profibus Remote Master (TCSEGPA23F14F)

Schneider Electric Profibus Remote Master (TCSEGPA23F14F) All versions

Pro-face HMI

GP4000H/R/E Series

Schneider Electric Pro-face HMI GP4000H/R/E Series

GP4100 Compact Series

Schneider Electric Pro-face HMI GP4100 Compact Series

LT4000M Modular Series

Schneider Electric Pro-face HMI LT4000M Modular Series

GP4000E Series

Schneider Electric Pro-face HMI GP4000E Series

SP5000 Series

Schneider Electric Pro-face HMI SP5000 Series

SP5000X Series

Schneider Electric Pro-face HMI SP5000X Series

GP-ProEX

Schneider Electric GP-ProEX  V4.09.100 and prior

SCADAPack 53xE RTUs

Schneider Electric SCADAPack 53xE RTUs  V8.14.7 and prior

SCADAPack 57x RTUs

Schneider Electric SCADAPack 57x RTUs V9.2.3 and earlier

SCD6000 Industrial RTU

<=7.0.34 SY-1101207_G17

Schneider Electric SCD6000 Industrial RTU V7.0.34 SY-1101207_G17 and prior

Tricon Communication Modules TCM/TCM2

>=11.1 | <=11.4

Schneider Electric Tricon Communication Modules TCM/TCM2 V11.1 - V11.4

Trident Communication Integration Module

Schneider Electric Trident Communication Integration Module V3.0

versadac™ Scalable Data Recorder

Schneider Electric versadac™ Scalable Data Recorder firmware V2.37 version and prior

Easergy MiCOM C264 [For PACiS (ESO) 6.3]

<D5.24 - C264 D5.X

Schneider Electric Easergy MiCOM C264 [For PACiS (ESO) 6.3] Versions prior to D5.24 - C264 D5.X

Easergy MiCOM C264 [For PACiS (ESO) 5.2]

<1.79 -  C264 D1.X

Schneider Electric Easergy MiCOM C264 [For PACiS (ESO) 5.2] Versions prior to 1.79 - C264 D1.X

Easergy MiCOM C264 [For PACiS (ESO) 6.1]

<D4.25 - C264 D4.X

Schneider Electric Easergy MiCOM C264 [For PACiS (ESO) 6.1] Versions prior to D4.25 - C264 D4.X

Easergy MiCOM P30 with rejuvenated Ethernet board CORTEC

Schneider Electric Easergy MiCOM P30 with rejuvenated Ethernet board CORTEC v66x

Easergy MiCOM P30

Schneider Electric Easergy MiCOM P30 v670

Easergy MiCOM Px40

All P40 with rejuvenated Ethernet board CORTEC digit 7=Q, R or S

Schneider Electric Easergy MiCOM Px40  All P40 with rejuvenated Ethernet board CORTEC digit 7=Q, R or S

Easergy P5

Schneider Electric Easergy P5 Firmware version: V01 Release: 001.029 Date: 29th May 2019

Easergy T300 (SC150 & LV150)

Schneider Electric Easergy T300 (SC150 & LV150) Firmware 1.5.2 and earlier

Schneider Electric ION7400 V2.1.0 and earlier

ION7400 MID (METSEION74001)

Schneider Electric ION7400 MID (METSEION74001)  V002.100.000 firmware version and earlier

Schneider Electric ION9000 V2.1.0 and earlier

Schneider Electric PM8000 V2.1.0 and earlier

PM8000 MID (METSEPM82401)

Schneider Electric PM8000 MID (METSEPM82401) V002.100.000 firmware version and earlier

SAGE RTU

K3 firmware and earlier for C3414 CPU

Schneider Electric SAGE RTU K3 firmware and earlier for C3414 CPU

Saitel DR with HU_A CPU

Schneider Electric Saitel DR with HU_A CPU V11.04.17 and earlier.

TeSys island

TeSysisland_001.100.013.sedp (01.0100)

Schneider Electric TeSys island Version TeSysisland_001.100.013.sedp (01.0100)

ConneXium Industrial Firewall/Router - TCSEFEC2CF3F21(MM/TX) - TCSEFEC23FCF21 (TX/MM) -  TCSEFEC23F3F21 (TX/TX)

Schneider Electric ConneXium Industrial Firewall/Router - TCSEFEC2CF3F21(MM/TX) - TCSEFEC23FCF21 (TX/MM) -  TCSEFEC23F3F21 (TX/TX) Version 5.37

E+PLC100 Combination PLC

Schneider Electric E+PLC100 Combination PLC V1.3.0.0

E+PLC400 Combination PLC

Schneider Electric E+PLC400 Combination PLC V1.3.0.0

Vijeo Basic runtime software

Schneider Electric Vijeo Basic runtime software V1.1.0.4404

Vijeo Designer

6.2 SP9 HotFix1 Alpha4

Schneider Electric Vijeo Designer V6.2 SP9 HotFix1 Alpha4

Modicon M580 Ethernet communications Modules Modicon M580 IEC 61850 - BMENOP0300 (C)

Schneider Electric Modicon M580 Ethernet communications Modules Modicon M580 IEC 61850 - BMENOP0300 (C) version 2.2

Modicon M580

Schneider Electric Modicon M580 BMEP584040 V3.10

Schneider Electric Modicon M580 BMEH584040 and C 3.10

Schneider Electric Modicon M580 BMEP586040 and C 3.10

Schneider Electric Modicon M580 BMEH586040 and C 3.10

Schneider Electric Modicon M580 BMEP581020 and H 3.10

Schneider Electric Modicon M580 BMEP582020 and H 3.10

Schneider Electric Modicon M580 BMEP582040 and H 3.10

Schneider Electric Modicon M580 BMEP583020 3.10

Schneider Electric Modicon M580 BMEP583040 3.10

Schneider Electric Modicon M580 BMEP584020 3.10

Schneider Electric Modicon M580 BMEP585040 and C 3.10

Schneider Electric Modicon M580 BMEH582040 and C 3.10

Schneider Electric Modicon M580 BMEP584040S 3.10

Schneider Electric Modicon M580 BMEH584040S 3.10

Schneider Electric Modicon M580 BMEH586040S 3.10

Schneider Electric Modicon M580 BMEP582040S 3.10

Modicon MC80 Programmable Logic Controller

Schneider Electric Modicon MC80 Programmable Logic Controller V1.5

Modicon Momentum Unity

Schneider Electric Modicon Momentum Unity SV2.10

Modicon Quantum 140CRA31200

Schneider Electric Modicon Quantum 140CRA31200 V2.50

Modicon Quantum 140CRA31908

Schneider Electric Modicon Quantum 140CRA31908 V2.50

Nanodac Recorder / Controller

Schneider Electric Nanodac Recorder / Controller V8.16

SCD6000 Industrial RTU

7.0.36 SY - 1101207_G18

Schneider Electric SCD6000 Industrial RTU V7.0.36 SY - 1101207_G18

Easergy P5

Schneider Electric Easergy P5 Firmware version: V01 Release: 200.008 Release date: 15th Nov 2019

Easergy T300 (SC150 & LV150)

Schneider Electric Easergy T300 (SC150 & LV150) version - 2.7

ION7400 MID (METSEION74001)

Schneider Electric ION7400 MID (METSEION74001)  V002.002.001

PM8000 MID (METSEPM82401)

Schneider Electric PM8000 MID (METSEPM82401) V002.002.001

TeSys island

Schneider Electric TeSys island TeSysisland_002.100.013.sedp (02.0100) or later version

versadac™ Scalable Data Recorder

Schneider Electric versadac™ Scalable Data Recorder V2.41

IEC 61850 communication module BMENOP0300

Schneider Electric IEC 61850 communication module BMENOP0300

Schneider Electric GP-ProEX  V4.09.100 and prior installed on Pro-face IoT Gateway

Schneider Electric Vijeo Designer V6.2 SP9 and prior installed on Schneider Electric Magelis HMI HMIGTO Series

Schneider Electric Vijeo Designer V6.2 SP9 and prior installed on Schneider Electric Magelis HMI HMISCU Series

Schneider Electric Vijeo Designer V6.2 SP9 and prior installed on Schneider Electric Magelis HMI HMIGTUX Series

Schneider Electric Vijeo Designer V6.2 SP9 and prior installed on Schneider Electric Magelis HMI HMIGTU Series

Schneider Electric GP-ProEX  V4.09.100 and prior installed on Schneider Electric Pro-face HMI GP4000H/R/E Series

Schneider Electric GP-ProEX  V4.09.100 and prior installed on Schneider Electric Pro-face HMI GP4100 Compact Series

Schneider Electric GP-ProEX  V4.09.100 and prior installed on Schneider Electric Pro-face HMI LT4000M Modular Series

Schneider Electric GP-ProEX  V4.09.100 and prior installed on Schneider Electric Pro-face HMI GP4000E Series

Schneider Electric GP-ProEX  V4.09.100 and prior installed on Schneider Electric Pro-face HMI SP5000 Series

Schneider Electric GP-ProEX  V4.09.100 and prior installed on Schneider Electric Pro-face HMI SP5000X Series

Schneider Electric Vijeo Designer V6.2 SP9 and prior installed on Schneider Electric Magelis HMI HMIGTU Series - Open Box

Remediating these vulnerabilities requires Schneider Electric to update affected products’ firmware.
Customers cannot directly apply Wind River patches.
We have downloaded Wind River’s patches and have established remediation plans to ensure all
current and future Schneider Electric products that rely on the Wind River platform evolve with these
embedded fixes. Integrating and validating Wind River’s patches requires thorough testing and
possibly recertification to ensure the quality of the updated product.
This bulletin will be updated as remediations become available. For all other affected products,
customers should refer to mitigations to reduce risk to their installations.

Remediations and Mitigations

Since the vulnerabilities are present in the TCP/IP stack of the VxWorks product, an active network
connection is required to exploit them. Therefore, Schneider Electric customers can act now to
mitigate the risk of attack by limiting access to their devices, which would immediately reduce
attempted exploits:
• Limit access to the networks on which Schneider Electric devices are placed.
• Do not expose Schneider Electric devices directly to the internet.
• Restrict external network connectivity to the affected devices.
• Always place Schneider Electric devices behind firewalls and/or other security protection
appliances that limit access only to authorized remote connections.
• Continually monitor affected devices for security events that could warn of attempted
unauthorized access.
• Limit access to internal networks where devices reside.
For more details and assistance on how to protect your installation, please contact your local
Schneider Electric’s Industrial Cybersecurity Services organization, which is fully aware of this
situation and can support you through the process.

Customers should immediately apply
the mitigations proposed in the
mitigation section of this document
and in the Cybersecurity Reference
Manual to reduce the risk of exploit:
https://www.se.com/ww/en/download
/document/EIO0000001999/

Software Version 5.37 available
here:
https://www.schneiderelectric.com/en/download/document/
TCSEFEC23FxF21/

These models have reached their
end of life in January 2015 and are
no longer commercially
available. Please apply
the mitigations proposed and/or
upgrade to current models. Contact
your local technical support for more
information.

Contact your local Eurotherm
technical support https://www.eurotherm.com/en/support  to get firmware
V1.3.0.0.

Contact your local technical support https://www.schneider-electric.com/en/work/support/contacts.jsp
to get the Vijeo Basic runtime
V1.1.0.4404 software

Contact your local technical support https://www.schneider-electric.com/en/work/support/contacts.jsp
to get the Vijeo Designer V6.2 SP9
HotFix1 Alpha4.

BMEAHI0812:
https://www.se.com/ww/en/download
/document/BMEAHI0812_Firmware_
upgrade/

BMEAHO0412:
https://www.se.com/ww/en/download
/document/BMEAHO0412_Firmware
_upgrade/

BMENOS0300 (C):
https://www.se.com/ww/en/download
/document/BMENOS0300_Firmware
_/

BMXCRA31200:
https://www.se.com/ww/en/download
/document/BMXCRA31200_FW_and
_FW_History

BMXCRA31210 (C):
https://www.se.com/ww/en/download
/document/BMXCRA31210_FW_and
_FW_History

BMECRA31210 (C):
https://www.se.com/ww/en/download
/document/BMECRA31210_FW_and
_FW_History

Firmware update is available through
Schneider Electric Software Update
(SESU). Download the SESU client
here
https://www.seupdate.schneiderelectric.com/download/SystemConsis
tency/SoftwareUpdate/SESU_231/S
ESU_2.3.1_setup_sfx.exe

Firmware is available through SESU
update or in Machine Expert 2.0
available in the following link:
https://www.se.com/ww/en/productrange-download/2226-ecostruxuremachine-expert/#/software-firmwaretab

Firmware is available through SESU
update or in Machine Expert 2.0
available in the following link:
https://www.se.com/ww/en/productrange-download/2226-ecostruxuremachine-expert/ - /softwarefirmware-tab

Firmware update is the Schneider
Electric Software Update (SESU).
Download the SESU client here
https://www.update.schneiderelectric.com/download/SystemConsis
tency/SoftwareUpdate/SESU_220/S
ESU_2.2.0_setup_sfx.exe

BMENOC0311:
https://www.se.com/ww/en/download
/document/BMENOC0311+Exec+an
d+Release+Notes/

BMENOC0301: https://www.se.com/
ww/en/download/document/BMENO
C0301+Exec+and+Release+Notes/

A fix is available in version 2.2:
https://www.se.com/ww/en/product/B
MENOP0300/m580-iec-61850-
communication-module/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP584040 https://www.schneiderelectric.com/en/download/document/M580_BMEP584040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEH584040 and C https://www.schneiderelectric.com/en/download/document/M580_BMEH584040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP586040 and C
https://www.schneiderelectric.com/en/download/document/M580_BMEP586040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
https://www.schneider-electric.com/en/download/document/M580_BMEH586040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP581020 and H https://www.schneiderelectric.com/en/download/document/M580_BMEP581020_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP582020 and H
https://www.schneiderelectric.com/en/download/document/M580_BMEP582020_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP582040 and H
https://www.schneiderelectric.com/en/download/document/M580_BMEP582040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP583020
https://www.schneiderelectric.com/en/download/document/M580_BMEP583020_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP583040
https://www.schneiderelectric.com/en/download/document/M580_BMEP583040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP584020
https://www.schneiderelectric.com/en/download/document/M580_BMEP584020_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP585040 and C
https://www.schneiderelectric.com/en/download/document/M580_BMEP585040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEH582040 and C
https://www.schneiderelectric.com/en/download/document/M580_BMEH582040_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP584040S https://www.schneiderelectric.com/en/download/document/M580_BMEP584040S_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEH584040S https://www.schneiderelectric.com/en/download/document/M580_BMEH584040S_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEH586040S https://www.schneider-electric.com/en/download/document
/M580_BMEH586040S_SV3.10/

A fix is available on Modicon M580
firmware V3.10, find links to fixed
versions in the Download Links
section
BMEP582040S https://www.schneiderelectric.com/en/download/document/M580_BMEP582040S_SV3.10/

A fix is available in V1.5:
https://www.se.com/ww/en/productrange-download/62396-modiconmc80/?filter=business-1-industrialautomation-and-control#/softwarefirmware-ta

A fix is available in SV2.10 -
https://www.se.com/ww/en/download
/document/Momentum_FW_update/

These models have reached their
end of life. Please apply the
mitigations proposed and/or upgrade
to Modicon M580 offer. Contact your
local technical support https://www.schneider-electric.com/en/work/support/contacts.jsp  for more
information.

A fix is available in V2.50, available
here for:
140CRA31200
https://www.se.com/ww/en/download
/document/_140CRA31200_FW_and
_FW_History

A fix is available in V2.50, available
here for:
140CRA31908
https://www.se.com/ww/en/download
/document/_140CRA31908_FW_and
_FW_History

These models have reached their
end of life in December 2018 and are
no longer commercially
available. Please apply
the mitigations proposed and/or
upgrade to IEC 61850
communication module
BMENOP0300. Contact your local
technical support https://www.schneider-electric.com/en/work/support/contacts.jsp  for more
information.

A fix is available in V8.16:
https://www.eurotherm.com/?wpdmdl
=28419

Firmware is available in Machine
Expert 1.2 available in the following
link:
https://www.se.com/ww/en/productrange-download/2226-ecostruxuremachine-expert/#/software-firmwaretab

Firmware update is available through
GP-Pro EX software. GP-Pro EX is
available in the following link:
https://www.proface.com/en/downloa
d/update/gpproex/v409

Contact your local technical support https://www.schneider-electric.com/en/work/support/contacts.jsp
or email supportTRSS@se.com for
the latest version.

A fix is available in V7.0.36 SY1101207_G18. Contact your local
technical support https://pasupport.schneider-electric.com/  for more
information.

Contact your local technical support:
https://pasupport.schneiderelectric.com

Contact your local Eurotherm
technical support https://www.eurotherm.com/en/support  to obtain firmware
V2.41.

Contact your local technical support https://www.schneider-electric.com/en/work/support/contacts.jsp
or the Energy Application Center
(EAC) for assistance in upgrading to
the new version.

Firmware version: V01 Release:
200.008 Release date: 15th Nov
2019 Please Contact your local
technical support https://www.schneider-electric.com/en/work/support/contacts.jsp  for assistance.

Contact your local technical support https://www.schneider-electric.com/en/work/support/contacts.jsp
or the Energy Application Center
(EAC) for assistance in upgrading to
the new version – 2.7.

V002.002.001
https://www.se.com/ca/en/download/
document/ION7400_MID_meter_FW
_v2.2.1/

V002.002.001
https://www.se.com/ca/en/download/
document/PM8000_MID_meter_FW_
v2.2.1/

Download version
TeSysisland_002.100.013.sedp (02.0
100) or later version.
Download link:
https://www.se.com/us/en/download/
document/TeSysisland_002.100.013.
zip/ (also available via SoMove with
the installed DTM)


Apache Log4j Vulnerabilities (Log4Shell)

Summary: Original Release

Summary: EcoStruxure™ IT Gateway and EcoStruxure™ IT Expert added to available remediations section

Summary: APC PowerChute Business Edition and APC PowerChute Network Shutdown added to affected products section

Summary: Overview updated to include CVE-2021-45046, Facility Expert Small Business and Wiser by SE platform added to list of available remediations, EASYFIT, Ecoreal XL, Eurotherm Data Reviewer, MSE, NetBotz750/75, NEW630, SDK BOM, SDK-Docgen, SDK-TNC, SDK-UMS, SDK3D-2DRenderer, SDK3D-360Widget, SNC-API, SNC-CMM, SNC-SEMTECH, SPIMV3, SWBEditor, SWBEngine added to list of affected products.

Summary: CVE-2021-4104 added to the scope of this security notification.

Summary:
-Updated information for Facility Expert SmallBusiness and Wiser by SE Platform in availableremediations section (page 3)
-Workplace Advisor added to list of affectedoffers (page 7)

Summary:
-Updated information for Facility Expert SmallBusiness and Wiser by SE Platform and addedHarmony Configurator, MSE, NetBotz750/755,SDK-Docgen, SDK-UMS, SNC-API, SNC-CMM,SNC-SEMTECH to list available remediations.(page 3-4)
-Upon further investigation the following productshave been determined to not be affected by theLog4j vulnerabilities and have been removedfrom the list of affected offers: EASYFIT,Ecoreal XL, NEW630, SDK BOM, SDK-TNC ,SDK3D-2DRenderer, SDK3D-360Widget,SPIMV3, SWBEditor, SWBEngine

Summary: Added TwinBus IP (formerly Digides 2.0) and Select and Config DATA to list available remediations. (page 3 and 4)

Summary: Added CVE-2021-44832 to the scope of this security notification (page 1)

Summary: Remediations updated for EcoStruxure™ IT Gateway & EcoStruxure™ IT Expert to address CVE-2021-45105.

Summary: Netbotz remediation updated due to stability issue on version 5.3.1.

Summary: Remediation available for APC PowerChute Business Edition, APC PowerChute Network Edition, and EMA Server.

Summary: Remediation update for Workplace Advisor.

Summary: Remediation update for Eurotherm Data Reviewer.

Summary: A remediation is now available for Netbotz 750/755

Summary: Apache Log4j Vulnerabilities (Log4Shell) - SESB-2021-347-01 PDF Version

Summary: Apache Log4j Vulnerabilities (Log4Shell) - SESB-2021-347-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of the vulnerabilities impacting Apache Log4j, including CVE-2021-44228, also known as Log4Shell. Our cybersecurity team is actively investigating the impact of the vulnerability on Schneider Electric offers and will continuously update this notification as information becomes available.
In the meantime, customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from exploitation of this vulnerability. Where appropriate, this includes locating their systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the recommended mitigations and general security recommendations below.
Please subscribe to the Schneider Electric security notification service to be informed of critical updates to this notification, including information on affected products and remediation plans:
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center.
August 2022 Update: Remediation update for Eurotherm Data Reviewer.

Overview

Schneider Electric

APC PowerChute Business Edition

Schneider Electric APC PowerChute Business Edition version 9.5

Schneider Electric APC PowerChute Business Edition version 10.0

Schneider Electric APC PowerChute Business Edition version 10.0.1

Schneider Electric APC PowerChute Business Edition version 10.0.2

Schneider Electric APC PowerChute Business Edition version 10.0.3

Schneider Electric APC PowerChute Business Edition version 10.0.4

Schneider Electric APC PowerChute Business Edition version 10.0.5

APC PowerChute Network Shutdown (PCNS)

Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.4.1

Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.3

Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.2

Schneider Electric APC PowerChute Network Shutdown (PCNS) version 4.5 and earlier

EcoStruxure™ IT Gateway

Schneider Electric EcoStruxure™ IT Gateway <=1.5.0|>=1.13.1.5

Schneider Electric EcoStruxure™ IT Gateway version 1.13.2.3

EcoStruxure™ IT Expert Cloud

Schneider Electric EcoStruxure™ IT Expert Cloud

Eurotherm Data Reviewer software

Schneider Electric Eurotherm Data Reviewer software version 3.0.2 and prior

Schneider Electric Eurotherm Data Reviewer software version 4.0.0

Facility Expert Small Business Cloud

Schneider Electric Facility Expert Small Business Cloud

Harmony Configurator

Schneider Electric Harmony Configurator version 33 and prior

NetBotz 750/755

Schneider Electric NetBotz 750/755 <=5.0|>=5.3.0

Select and Config DATA Cloud

Schneider Electric Select and Config DATA Cloud

TwinBus IP (formerly Digides 2.0) Cloud

Schneider Electric TwinBus IP (formerly Digides 2.0) Cloud

Wiser™ by SE Platform Cloud

Schneider Electric Wiser™ by SE Platform Cloud

Eurotherm Data Reviewer

Schneider Electric Eurotherm Data Reviewer version 3.0.2 and prior

CVE-2021-44228

Schneider Electric has deployed a fix to update SDK-UMS to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update Select and Config DATA to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update SNC-API to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update SNC-CMM to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update SNC-SEMTECH to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update TwinBus IP to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update Workplace Advisor to Log4j 2.17.
These fixes were deployed implemented on all public facing portals on January 14, 2022 and require no action from customers.

Schneider Electric has deployed a fix to update the Wiser by SE Platform to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric is establishing a remediation plan for all future versions of Eurotherm Data Reviewer that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the mitigations found in the document below to reduce the risk of exploit:
https://download.schneider-electric.com/files?p_Doc_Ref=EDR-Log4Shell-Mitigations
The above settings change will not alter the behavior of the Eurotherm Data Reviewer software
Note: Eurotherm Data Reviewer uses a defense-in-depth strategy for security. It is currently not possible to exploit this vulnerability without logging into the server hosting Reviewer with administrator privileges

Customers should use an IoT/OT-aware network detection and response (NDR) solution and SIEM/SOAR solution to auto-discover and continuously monitor devices for anomalous or unauthorized behaviors, such as communication with unfamiliar local or remote hosts.

PowerChute Business Edition V10.0.5 has been updated with log4j V 2.17.0 which includes a fix for these vulnerabilities and can be downloaded here: https://www.apc.com/shop/us/en/products/PowerChute-Business-Edition-v10-0-5/P-SFPCBE1005
10.0.5 Release Notes:
https://download.schneider-electric.com/files?p_File_Name=990-3029P-EN.pdf&p_Doc_Ref=SPD_CCON-AT6CWT_EN&p_enDocType=User+guide
For more information, please see this FAQ: https://www.apc.com/my/en/faqs/FAQ000229596/

For PowerChute Network Shutdown customers who would like to use Dell VxRail enabled NMC cards, please update to version PCNS 4.5 or later, which includes a fix for these vulnerabilities. Otherwise, customers on PowerChute Network Shutdown versions 4.3, 4.4, and 4.4.1 should follow these remediations steps:
•Download the corresponding V4.4.1.1, 4.4.0.1,4.3.0.1 scripts and follow the instructions available athttps://www.apc.com/my/en/faqs/FAQ000229596/.
•These scripts remove the vulnerable log4j files andreplace them with log4j V2.17.1 files, which include afix for these vulnerabilities.

Version 1.13.2.3 of EcoStruxure™ IT Gateway has been
updated with log4j V2.17.0, which includes a fix for these
vulnerabilities, and is available via automatic update if
enabled.
Update manually by logging into EcoStruxureit.com, or by downloading the update directly from here: https://EcoStruxureit.com/download-and-set-up-EcoStruxurit-gateway/

The cloud-based EcoStruxure™ IT Expert has been updated has been updated with log4j V2.17, which includes a fix for these vulnerabilities.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update EMA Server cloud offer to Log4j2.17.1.
These fixes have been deployed automatically and require no action from customers.

Version 4.0.0of Eurotherm Data Reviewer includes a fix for this vulnerability and is available for download here:
https://www.eurotherm.com/?wpdmdl=78469

Schneider Electric has deployed a fix to update the Facility Expert Small Business cloud application to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Harmony Configurator has been updated with log4j V2.17, which includes a fix for these vulnerabilities.
These fixes have been deployed automatically and require no action from customers.

Schneider Electric has deployed a fix to update MSE to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

For software V5.0.1 - 5.3.x of Netbotz 750/755 there is a patch that includes a fix for this vulnerability.
The patch is available thru your local tech support who can be reached here: https://www.se.com/ww/en/work/support/country-selector/contact-us.jsp

Schneider Electric has deployed a fix to update SDK-Docgen to Log4j 2.17.
These fixes have been deployed automatically and require no action from customers.

Log4j is an open-source Java logging library developed by the Apache Foundation which is widely used by both enterprise applications and cloud services. The recent Apache Log4j vulnerabilities are listed below and have ratings ranging from High to Critical. CVE-2021-44228 (Log4Shell), received a rating of Critical and can allow an attacker who can control log messages or log message parameters to execute arbitrary code loaded from LDAP servers and other JNDI related endpoints when message lookup substitution is enabled. Exploitation could allow for unauthenticated remote code execution (RCE) and possibly access to servers. Additional CVEs within the scope of this security notification:
CVE-2021-44228
CVE-2021-45046
CVE-2021-45105
CVE-2021-4104
CVE-2021-44832
For more information, please visit the Apache logging services log4j security page https://logging.apache.org/log4j/2.x/security.html.

CVE-2021-45046

CVE-2021-45105

CVE-2021-4104

CVE-2021-44832


GoAhead Web Server vulnerability

Summary: Original Release

Summary: Updated overview and remediation section (pages 1-3)

Summary: GoAhead Web Server vulnerability - SEVD-2015-344-01 PDF Version

Summary: GoAhead Web Server vulnerability - SEVD-2015-344-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a proof of concept exploit available for this vulnerability. It is
imperative that customers upgrade the firmware for the affected products.

Overview

Schneider Electric BMXNOC0401 prior to v2.09

Schneider Electric BMXNOE0100 prior to v3.10

Schneider Electric BMXNOE0100H prior to v3.10

Schneider Electric BMXNOE0110 prior to v6.30

Schneider Electric BMXNOE0110H prior to v6.30

Schneider Electric BMXNOR0200 prior to v1.70

Schneider Electric BMXNOR0200H prior to v1.70

Schneider Electric BMXP342020 prior to v2.80

Schneider Electric BMXP342020H prior to v2.80

Schneider Electric BMXP342030 prior to v2.80

Schneider Electric BMXP3420302 prior to v2.80

Schneider Electric BMXP3420302H prior to v2.80

Schneider Electric BMXPRA0100 prior to v2.80

CVE-2015-7937

Stack-based buffer overflow in the GoAhead Web Server on Schneider Electric Modicon M340
PLC BMXNOx and BMXPx devices allows remote attackers to execute arbitrary code.

CVE Description

This model has reached its end of life inn 2009. Please apply
the mitigations below. Contact your local technical support for
more information.
Customers are advised that the webserver is disabled by default. Because web services are
only necessary for specific maintenance, configuration, or monitoring activities, it is advised to
disable web services all together during times when the services are not needed. Customers
are also advised to:
• Configure access control lists to restrict web server access to authorized IP addresses.
• Protect access to Modicon products with network, industrial, and application firewalls.


Summary: Original Release

Summary: Updated CVSS scores and addition of Modicon M580 and clarification on Modicon M340 affected products.

Summary: A fix is available for Modicon M340 v3.50 that addresses the CVE-2018-7242 vulnerability. The list of impacted offers and version details have been updated for CVE-2018-7240, CVE-2018-7241, CVE-2018-7242 and CVE-2011-4859 vulnerabilities.

Summary: The version number for Modicon M580that addresses these vulnerabilities has been updated from V4.01 to V4.02.

Summary: A remediation is available for Modicon X80 Ethernet Communication module BMXNOC0401 and BMXNOR0200H RTU.

Summary: Adding a clarification to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 SV4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document.

Summary: The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

Summary: A remediation is available for CVE-2018-7242 on Modicon M340 Ethernet Communication Modules BMXNOE0100 (H) and BMXNOE0110 (H).

Summary: A remediation is available for the Modicon M580 CPU Safety (page 4).

Summary: Embedded FTP Servers for Modicon PAC Controllers - SEVD-2018-081-01 PDF Version

Summary: Embedded FTP Servers for Modicon PAC Controllers - SEVD-2018-081-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in the FTP servers of its Modicon PAC controllers.

Modicon PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way. Our PLCs and PACs supply edge technology, augmenting it with Ethernet connectivity, built-in cybersecurity, and processing power needed to handle Big Data analysis and protect against new vulnerabilities among connected industrial assets, across devices or into the cloud.

Failure to address these vulnerabilities could result in unauthorized access to your PLC and a denial of service or other malicious activity.

March 2023 Update: Remediation for the Modicon M580 CPU is available for download

Overview

Schneider Electric

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S & BMEH58*S) Versions prior to SV4.21

Modicon RTU BMXNOR0200H

<V1.7 IR24

Schneider Electric Modicon RTU BMXNOR0200H <V1.7 IR24

Modicon RTU BMXNOR0200H

V1.7 IR24

Schneider Electric Modicon RTU BMXNOR0200H V1.7 IR24

Schneider Electric Modicon X80 Ethernet Communication Module <V2.11

Schneider Electric Modicon X80 Ethernet Communication Module V2.11

All Versions

Schneider Electric Modicon X80 Ethernet Communication Module All Versions

Legacy Modicon Premium and Quantum

Schneider Electric Legacy Modicon Premium and Quantum All Versions

Modicon M580

Schneider Electric Modicon M580 <=SV3.20

Modicon M580 CPU Safety

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S & BMEH58*S) Version SV4.21

CVE-2018-7240

A CWE-522: Insufficiently Protected Credentials vulnerability exists that could cause arbitrary code execution or malicious firmware installation when FTP upgrade feature is enabled. Special command dedicated to firmware upgrade can be called to execute DoS attack. Also, malicious crafted firmware can be transferred and loaded into PLC causing unauthorized code execution.

CVE Description

Version 3.50 of Modicon M340 includes a fix for CVE-2018-7242 vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.

Firmware SV4.10 includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/

If customers choose not to apply the remediation, then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.
•	Ensure the CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPU Memory Protection section”: https://www.schneider-electric.com/en/download/document/EIO0000001999/
	NOTE: The CPU memory protection cannot be configured with Hot Standby CPUs. In such cases, use IPsec encrypted communication

Firmware SV4.21 includes a fix for these vulnerabilities and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac-controller/#software-and-firmware
 Important: customer needs to use version of EcoStruxure™
Control Expert V16.0 HF001 minimum to connect with the latest
version of M580 CPU Safety. The software is available for
download here: tps://www.se.com/ww/en/product-range/548-ecostruxurecontrol-expert-unity-pro/#software-and-firmware

If customers choose not to apply the remediation, then they are encouraged to immediately apply the following mitigations to reduce the risk of exploit:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.

To further reduce the attack surface on Modicon M580 CPU Safety:
•	Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

Version 1.7 IR24 of BMXNOR0200H X80 RTU includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/BMXNOR0200H/

If customers choose not to apply the remediation then they should immediately apply the following mitigations to reduce the risk of exploit:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.

Version 2.11 of Modicon X80 Ethernet Communication modules BMXNOC0401 includes a fix for these vulnerabilities and is available for download here:
https://www.se.com/ww/en/product/BMXNOC0401/

If customers choose not to apply the remediation, then they should immediately apply the following mitigations to reduce the risk of exploit:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.

Schneider Electric is establishing a remediation plan for all future versions of Modicon X80 Ethernet Communication modules BMXNOE0100 (H). We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.

Schneider Electric’s Modicon Premium and Quantum controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our current product offer.

Customers should strongly consider migrating to the Modicon M580 ePAC. Please contact your local Schneider Electric technical support for more information.

To mitigate the risks associated to the FTP weaknesses, users should immediately:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.

CVE-2018-7241

A CWE-798: Use of Hard-coded Credentials vulnerability exists in the firmware that could cause access by an unauthorized user to the controller when FTP protocol is enabled.

CVE Description

CVE-2011-4859

A CWE-798: Use of Hard-coded Credentials vulnerability exists in the Operating System that could cause access by an unauthorized user to the controller when FTP protocol is enabled.

CVE Description

Kirill Chernyshov
Ilya Karpov
Ivan Kurnakov
Nikita Maximov

Schneider Electric is establishing a remediation plan for all future versions of Modicon M580 CPU Safety that will include a fix for these vulnerabilities. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit:
•	Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the controllers.
•	Deactivate the FTP service when not needed.
•	Use Access Control List to restrict communication to the authorized IP addresses. Refer to the Configuring Access Control section in the user manual for each module.

To further reduce the attack surface on Modicon M580 CPU Safety:
•	Ensure the CPU is running in Safety mode and maintenance input is configured to maintain this Safety mode during operation – refer to the document Modicon M580 - Safety System Planning Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

CVE-2018-7242

A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could make the algorithm used to encrypt the password vulnerable and make it easier for remote attackers to obtain access when hash collision attacks are executed over Telnet or FTP.

CVE Description


Security Notification - U.motion Builder software

Summary: Original Release

Summary: Removed CVE-2018-7775 as it is a duplicate of CVE-2017-9960

Summary: Updated remediation section and overview section

Summary: Security Notification – U.motion Builder software - SEVD-2018-095-01 PDF Version

Summary: Security Notification – U.motion Builder software - SEVD-2018-095-01 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of an exploit that targets Schneider Electric’s U.motion Builder
software. It is imperative customers cease using U.motion Builder software and remove it from
their systems immediately.

Overview

Schneider Electric

U.motion Builder Software

Schneider Electric U.motion Builder Software all versions prior to 1.3.4

CVE-2018-7763

Css.inc Directory Traversal Information Disclosure
The vulnerability exists within css.inc.php. The 'css' parameter contains a directory traversal
vulnerability.

CVE Description

To further protect their installations from this threat, customers should immediately remove the
U.motion Builder software from their systems.
The product has been retired and is no longer available or supported.

CVE-2018-7764

runscript Directory Traversal Information Disclosure
The vulnerability exists within runscript.php applet. There is a directory traversal vulnerability in
the processing of the 's' parameter of the applet.

CVE Description

CVE-2018-7765

track_import_export SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of track_import_export.php. The underlying SQLite
database query is subject to SQL injection on the object_id input parameter.

CVE Description

CVE-2018-7766

track_getdata SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of track_getdata.php. The underlying SQLite database
query is subject to SQL injection on the id input parameter.

CVE Description

CVE-2018-7767

editobject SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of the editobject.php. The underlying SQLite database
query is subject to SQL injection on the type input parameter.

CVE Description

CVE-2018-7768

loadtemplate SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of loadtemplate.php. The underlying SQLite database
query is subject to SQL injection on the tpl input parameter.

CVE Description

CVE-2018-7769

xmlserver SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of xmlserver.php. The underlying SQLite database
query is subject to SQL injection on the id input parameter.

CVE Description

CVE-2018-7770

sendmail email_attachment Parameter Absolute Path Traversal Information Disclosure
Vulnerability
The vulnerability exists within processing of sendmail.php. The applet allows callers to select
arbitrary files to send to an arbitrary email address.

CVE Description

CVE-2018-7771

editscript Directory Traversal Remote Code Execution Vulnerability
The vulnerability exists within processing of editscript.php. A directory traversal vulnerability
allows a caller with standard user privileges to write arbitrary php files anywhere in the web
service directory tree,

CVE Description

CVE-2018-7772

HTTP Cookie SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of applets which are exposed on the web service. The
underlying SQLite database query to determine whether a user is logged in is subject to SQL
injection on the loginSeed parameter, which can be embedded in the HTTP cookie of the
request.

CVE Description

CVE-2018-7773

nfcserver SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of nfcserver.php. The underlying SQLite database
query is subject to SQL injection on the sessionid input parameter.

CVE Description

CVE-2018-7774

localize SQL Injection Remote Code Execution Vulnerability
The vulnerability exists within processing of localize.php. The underlying SQLite database query
is subject to SQL injection on the username input parameter.

CVE Description

CVE-2018-7776

Error Information Disclosure Vulnerability
The vulnerability exists within error.php. System information is returned to the attacker that
contains sensitive data.

CVE Description

CVE-2018-7777

Remote Code Execution
The vulnerability is due to insufficient handling of update_file request parameter on
update_module.php. A remote, authenticated attacker can exploit this vulnerability by sending a
crafted request to the target server.

CVE Description

CVE-2017-7494

Samba Cry - Malicious clients can upload and cause the smbd server to execute a shared
library from a writable share.

CVE Description