Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Vijeo Designer product.

 The Vijeo Designer https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/ product is HMI Configuration Software compatible with Harmony and Magelis HMI. Vijeo Designer software offers functions such as multimedia capabilities and remote access for more efficiency.

 Failure to apply the remediations provided below may risk privilege escalation, which could result in unauthorized access to workstation resources.

 July 2025 Update: A remediation is now available for EcoStruxure™ Machine Expert (with Vijeo Designer optional component installed).

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Summary: Vijeo Designer  - SEVD-2024-254-01 PDF Version

Summary: Vijeo Designer  - SEVD-2024-254-01 CSAF Version

Vijeo Designer

Summary: Original Release

Schneider Electric

Vijeo Designer

<6.3 SP1

Schneider Electric Vijeo Designer Versions prior to V6.3 SP1

6.3 SP1

Schneider Electric Vijeo Designer Version 6.3 SP1

EcoStruxure™ Machine Expert

Schneider Electric Vijeo Designer optional component of Schneider Electric EcoStruxure™ Machine Expert Versions prior to v2.3

Schneider Electric Vijeo Designer Version 6.3.2.16 optional component of Schneider Electric EcoStruxure™ Machine Expert Version 2.3

CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized
access, loss of confidentiality, integrity and availability of the workstation when non-admin
authenticated user tries to perform privilege escalation by tampering with the binaries

CVE Description

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:Limit authenticated user access to the workstation
running Vijeo Designer and implement existing User
Account Control practices.
• Remove the write permissions for “Everyone” on the
folder “C:\Program Files (x86)\Schneider Electric\VijeoDesigner 6.3\Vijeo-Runtime”
• Follow workstation, network and site-hardening
guidelines in the Recommended Cybersecurity Best
Practices guide available for download here.

Vijeo Designer version 6.3.2.16 delivered with EcoStruxure™ Machine Expert v2.3 includes a fix for this vulnerability. EcoStruxure™ Machine Expert v2.3 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER On the engineering workstation, install v2.3 of EcoStruxure™ Machine Expert.

Version V6.3 SP1 of Vijeo Designer includes a fix for this
vulnerability and can be updated through the Schneider
Electric Software Update (SESU) application.
https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware
On the engineering workstation, update to v6.3 SP1 of
Vijeo Designer.

CVE-2024-8306


Summary: Original Release

Summary: EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards - SEVD-2024-254-02 PDF Version

Summary: EcoStruxure™ Power Monitoring Expert and EcoStruxure™ Power Operation or EcoStruxure™ Power SCADA Operation with Advanced Reporting and Dashboards - SEVD-2024-254-02 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert
(PME) and EcoStruxure™ Power Operation (EPO) products.
EcoStruxure™ Power Monitoring Expert (PME) is an on-premises software used to help power.
critical and energy-intensive facilities maximize uptime and operational efficiency.
EcoStruxure™ Power Operation (EPO) and EcoStruxure™ Power SCADA Operation (PSO) are
on-premises software offers that provides a single platform to monitor and control medium and
lower power systems.
Failure to apply the remediations provided below could result in execution of malicious web
code, or unintended software operation.

Overview

Schneider Electric

<=2021 CU1

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) 2021 CU1 and prior

<=2020 CU3

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) 2020 CU3 and prior

EcoStruxure™ Power Operation (EPO) 2022

<=2022 CU4

Schneider Electric EcoStruxure™ Power Operation (EPO) 2022 CU4 and prior

<=2022 CU4

Schneider Electric EcoStruxure™ Power Operation (EPO) 2022 – Advanced Reporting and Dashboards Module 2022 CU4 and prior

EcoStruxure™ Power Operation (EPO) 2021

<=2021 CU3 Hotfix 2

Schneider Electric EcoStruxure™ Power Operation (EPO) 2021 CU3 Hotfix 2 and prior

<=2021 CU3 Hotfix 2

Schneider Electric EcoStruxure™ Power Operation (EPO) 2021 – Advanced Reporting and Dashboards Module 2021 CU3 Hotfix 2 and prior

Schneider Electric EcoStruxure™ Power SCADA Operation 2020 (PSO) - Advanced Reporting and Dashboards Module All Versions

2021 CU2

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) 2021 CU2

EcoStruxure™ Power Operation (EPO) 2022

2022 CU5

Schneider Electric EcoStruxure™ Power Operation (EPO) 2022 CU5

EcoStruxure™ Power Operation (EPO) 2021

2021 CU3 Hotfix 3

Schneider Electric EcoStruxure™ Power Operation (EPO) 2021 2021 CU3 Hotfix 3

CVE-2024-8401

CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)
vulnerability exists when an authenticated attacker modifies folder names within the context of
the product.

CVE Description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EcoStruxure™ Power Monitoring Expert 2021 CU2 includes a fix for
this vulnerability and is available for download here:
https://ecoxpert.se.com/software-center/power-monitoringexpert/
power-monitoring-expert-2021
OR
EcoStruxure™ Power Monitoring Expert 2022 includes a fix for this
vulnerability and is available for download here:
https://ecoxpert.se.com/software-center/power-monitoringexpert/
power-monitoring-expert-2022
OR
Upgrade to the latest version of EcoStruxure™ Power Monitoring
Expert. Contact the customer care center for more information.

EcoStruxure™ Power Operations 2022 CU5 includes a fix for this
vulnerability and is available for download here:
https://community.se.com/t5/EcoStruxure-Power-Operation/v2022-
Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058
OR
Upgrade to latest version of EcoStruxure™ Power Operations.
Contact the customer care center for more information.
Additionally, EcoStruxure™ Power operation 2022 with Advanced
Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will
need to update the version of EcoStruxure™ Power Monitoring
Expert installed independently of the EcoStruxure™ Power
Operation patch level installed and apply the appropriate
EcoStruxure™ Power Monitoring Expert update as outlined above.
For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.

EcoStruxure™ Power Operations 2021 CU3 Hotfix 3 includes a fix
for this vulnerability and is available for download here:
https://community.se.com/t5/EcoStruxure-Power-Operation/v2022-
Release-amp-Updates-Install-Procedure/m-p/416561/thread-id/6058
OR
Upgrade to latest version of EcoStruxure™ Power Operations.
Contact the customer care center for more information.
Additionally, EcoStruxure™ Power Operation 2021 with Advanced
Reporting utilizes EcoStruxure™ Power Monitoring Expert. You will
need to update the version of EcoStruxure™ Power Monitoring
Expert installed independently of the EcoStruxure™ Power
Operation patch level installed and apply the appropriate
EcoStruxure™ Power Monitoring Expert update as outlined above.
For assistance in determining the version of PME installed, contact the Schneider Electric Customer Care Center.

EcoStruxure™ Power Monitoring Expert 2020 is at its end-of-life
support.
Customers should consider upgrading to the latest version offering
of PME to resolve this issue. Please contact Schneider Electric
Customer Care Center for more details.

EcoStruxure™ Power SCADA Operation 2020 (PSO) - Advanced
Reporting and Dashboards Module is at its end-of-life support.
Customers should consider upgrading to the latest version offering
of EPO to resolve this issue. Please contact Schneider Electric
Customer Care Center for more details.


Data Center Expert

Summary: Original Release

Summary: Data Center Expert - SEVD-2024-282-01 PDF Version

Summary: Data Center Expert - SEVD-2024-282-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Data Center Expert product.
The Data Center Expert product is a scalable monitoring software that collects, organizes, and
distributes critical device information providing a comprehensive view of equipment.
Failure to apply the fix provided below may risk information disclosure, which could result in
access to private data.

Overview

Schneider Electric

Data Center Expert

Schneider Electric Data Center Expert Versions 8.1.1.3 and prior

Schneider Electric Data Center Expert version 8.2

CVE-2024-8531

CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that could
compromise the Data Center Expert software when an upgrade bundle is manipulated to
include arbitrary bash scripts that are executed as root.

CVE Description

Version 8.2 of EcoStruxure™ IT Data Center Expert
includes fixes for these vulnerabilities and is available
upon request from Schneider Electric’s
Customer Care Center.

Ensure that the principals of least privilege are being followed so that only those with need
have account access and that the level of their respective account authorization aligns
with their role, including Privileged Accounts as described in the Data Center Expert
Security Handbook.
• Verify SHA1 checksums of upgrade bundles prior to executing upgrades as described in
the Upgrades section of the Data Center Expert Security Handbook..
• Delete any existing “logcapture” archives present on the system and do not create any
new “logcapture” archives. Existing archives can be deleted from the
https://server_ip/capturelogs web page after authenticating.

CVE-2024-8530

CWE-306: Missing Authentication for Critical Function vulnerability exists that could
cause exposure of private data when an already generated “logcaptures” archive is accessed
directly by HTTPS.

CVE Description


Harmony iPC – HMIBSC IIoT Edge Box Core

Summary: Original Release

Summary: Harmony iPC – HMIBSC IIoT Edge Box Core - SEVD-2024-282-02 PDF Version

Summary: Harmony iPC – HMIBSC IIoT Edge Box Core - SEVD-2024-282-02 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Harmony iPC – HMIBSC IIoT Edge
Box Core family products operating system (OS).
The Harmony iPC – HMIBSC IIoT Edge Box Core products are edge compute products, which
enable secure communication from the shop floor to IT through improved asset performance for
more efficient operation and maintenance of capital assets.
Failure to apply the mitigations provided below may risk in various attack scenarios due to
legacy OS, components vulnerabilities which could result in operational failures.

Overview

Schneider Electric

Harmony iPC – HMIBSC IIoT Edge Box Core

Schneider Electric Harmony iPC – HMIBSC IIoT Edge Box Core All versions

Vulnerability Details

The third-party Yocto OS (v2.1 Krogoth) is used in the HMIBSC offer. It is known to contain
multiple high and critical risk vulnerabilities. Schneider Electric cannot update the OS on the
HMIBSC due to its hardware limitations and cannot provide further security updates to our
customers.

Harmony iPC - HMIBSC IIoT Edge Box Core family
products have reached its end of life and is no longer
supported.
Customers should immediately apply the following
mitigations to reduce the risk of exploit:
• Follow general Cyber Security practices listed inside
the Harmony IIoT Core Box HMIBSC User Manual -
Chapter 8
• Always use product provided password-based boot
to avoid unauthorized access.
• Implement network segmentation to isolate product
from other critical infrastructure components or make
air gapped systems. This limits the potential impact
of a security breach and prevents lateral movement
within the network.
• Limit the usage of Wi-Fi/4G/Bluetooth connections
and use Secure communications via EcoStruxure
Secure Connect/VPN if required.
• Stop the usage of Node-RED and close the TCP port
1880 as it increases attack surface when accessed
remotely.
• Restrict the login access to limited users according
to the least privilege policy.
• Limit the usage of unverified removable media.
• Disable unused services from the product to reduce
the attack surface.


Easergy Studio

Summary: Original Release

Summary: Easergy Studio - SEVD-2024-282-03 PDF Version

Summary: Easergy Studio - SEVD-2024-282-03 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Easergy Studio product.
The Easergy Studio product is a software solution for configuring, monitoring, and managing
control devices.
Failure to apply the remediation provided below may risk unauthorized access to the installation
directory for Easergy Studio which could allow an attacker with access to the file system to
elevate privileges.

Overview

Schneider Electric

Easergy Studio

Schneider Electric Easergy Studio Versions 9.3.1 and prior

Schneider Electric Easergy Studio version 9.3.4

CVE-2024-9002

CWE-269: Improper Privilege Management vulnerability exists that could cause unauthorized
access, loss of confidentiality, integrity, and availability of the workstation when non-admin
authenticated user tries to perform privilege escalation by tampering with the binaries.

CVE Description

Version 9.3.4 and later of Easergy Studio includes a fix for this vulnerability.
The fix was released in December 2022, and it is recommended that
customers use the latest version available:
https://www.se.com/ww/en/download/document/Easergy_Studio_Installer/


EVlink Home Smart and Schneider Charge

Summary: Original Release

Summary: EVlink Home Smart and Schneider Charge - SEVD-2024-282-04 PDF Version

Summary: EVlink Home Smart and Schneider Charge - SEVD-2024-282-04 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability with the potential disclosure of confidential
information in its EVlink Home Smart and Schneider Charge charging stations.
This is not related to any of the customer personal data and potential disclosure cannot be
exploited to abuse both products. This only relates to remote test equipment and test features
that are removed from production units.
A remediation for affected charging stations has already been deployed to all connected units.

Overview

Schneider Electric

EVlink Home Smart

Schneider Electric EVlink Home Smart all versions prior to 2.0.6.0.0

Schneider Electric EVlink Home Smart version 2.0.6.0.0

Schneider Charge

Schneider Electric Schneider Charge all versions prior to 1.13.4

Schneider Electric Schneider Charge version 1.13.4

CVE-2024-8070

CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test
credentials in the firmware binary.

CVE Description

For already connected products, version 2.0.6.0.0 of EVlink
Home Smart includes a fix for this vulnerability and has been
deployed to automatically upgrade all charging stations
connected to the Wiser application.
Make sure the charging station is connected to the Wiser
application to ensure the new version is downloaded and
installed.
For new installations, a fix for this vulnerability is enforced
through eSetup commissioning application.
The installed firmware version can be verified through Wiser
application (refer to the settings page for the charging
station).

For already connected products, version 1.13.4 of Schneider
Charge includes a fix for this vulnerability and has been
deployed to automatically upgrade all charging stations
connected to the Wiser application.
Make sure the charging station is connected to the Wiser
application to ensure the new version is downloaded and
installed.
For new installations, a fix for this vulnerability is enforced
through eSetup commissioning application.
The installed firmware version can be verified through either
Wiser application (refer to the settings page for the charging
station), or the third-party supervision application.


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document https://www.se.com/us/en/download/document/7EN52-0390/.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Power Monitoring Expert
(PME) product.

EcoStruxure™ Power Monitoring Expert (PME) https://www.se.com/us/en/product-range/65404-ecostruxure-power-monitoring-expert/#overview  is an on-premises software product used to help
power critical and energy-intensive facilities maximize uptime and operational efficiency.

Failure to apply the remediation provided below may risk deserialization of untrusted data,
which could result in Remote Code Execution.

March 2025 Update: The CVSS4.0 scoring has been added to the vulnerability details and more
specific remediation information provided.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center (https://www.se.com/us/en/work/support/) if you need assistance removing a patch.

Summary: EcoStruxure™ Power Monitoring Expert (PME) - SEVD-2024-282-05 PDF Version

Summary: EcoStruxure™ Power Monitoring Expert (PME) - SEVD-2024-282-05 CSAF Version

Summary: Original Release

Summary: Removed unreferenced product and its version from the product tree.

Schneider Electric EcoStruxure™ Power Monitoring Expert (PME) Version 2022

Schneider Electric EcoStruxure Power Monitoring Expert (PME) Version 2021 and prior

Schneider Electric EcoStruxure Power Monitoring Expert (PME) 2022 Hotfix_75031_PME2022

CWE-502: Deserialization of Untrusted Data vulnerability exists that could allow code to be
remotely executed on the server when unsafely deserialized data is posted to the web server.

CVE Description

Hotfix_75031_PME2022 available for EcoStruxure™ Power
Monitoring Expert (PME) that includes a fix for this vulnerability.
Contact Schneider Electric’s Customer Care Center https://www.se.com/us/en/work/support/  to download
this hotfix.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit.
EcoStruxure™ Power Monitoring Expert 2021 and prior have
reached end-of-life support.

Customers should consider upgrading to the latest version
offering of PME to resolve this issue. Please contact Schneider
Electric Customer Care Center https://www.se.com/us/en/work/support/  for more details.

CVE-2024-9005


Zelio Soft 2

Summary: Original Release

Summary: Zelio Soft 2 - SEVD-2024-282-06 PDF Version

Summary: Zelio Soft 2 - SEVD-2024-282-06 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of vulnerabilities in its Zelio Soft 2 product.
The Zelio Soft 2 software for Zelio Logic smart relays (SR2/ SR3) enables programming in
LADDER language or in function block diagram (FBD) language simulation, monitoring and
supervision uploading and downloading of programs output of personalized files automatic
compiling of programs.
Failure to apply the fix provided below may risk remote code execution, which could result in
resource exhaustion, information disclosure, or denial of service.

Overview

Customers should use appropriate patching methodologies when applying these patches to
their systems. We strongly recommend the use of back-ups and evaluating the impact of these
patches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch.

Overview

Schneider Electric

Zelio Soft 2

Schneider Electric Zelio Soft 2 Versions prior to 5.4.2.2

Schneider Electric Zelio Soft 2 Version 5.4.2.2

CVE-2024-8422

CWE-416: Use After Free vulnerability exists that could cause arbitrary code execution, denial
of service and loss of confidentiality & integrity when application user opens a malicious Zelio
Soft 2 project file.

CVE Description

Version 5.4.2.2 of Zelio Soft 2 includes a fix for these
vulnerabilities and can be updated through the Schneider
Electric Software Update (SESU) application and is also
available for download here:
https://www.se.com/ww/en/product-range/542-zelio-soft/#software-and-firmware.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Encrypt project files when stored and restrict the access to only trusted users.
• When exchanging files over the network, use secure communication protocols.
• Only open project files received from a trusted source.
• Compute a hash of the project files and regularly check the consistency of this hash to
verify the integrity before usage.

CVE-2024-8518

CWE-20: Improper Input Validation vulnerability exists that could cause a crash of the Zelio Soft
2 application when a specially crafted project file is loaded by an application user.

CVE Description


Summary: Original Release

Summary: System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2024-282-07 PDF Version

Summary: System Monitor Application in Harmony and Pro-face PS5000 Legacy Industrial PCs - SEVD-2024-282-07 CSAF Version

Summary: Recommended Cybersecurity Best Practices

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its System Monitor application of Harmony
Industrial PC Series and Pro-face PS5000 trusted Legacy industrial PC Series product(s).
The Harmony Industrial PC Series and Pro-face PS5000 legacy industrial PC Series are iPCs
which incorporate slim, flexible and durable design allowing each customer to configure their
iPC based on their individual application needs. These products offer flexible connectivity to a
range of devices and designs.
Failure to apply the remediations provided below may risk denial of service, sensitive
information disclosure, integrity issues , which could result in operational failures.

Overview

Schneider Electric System Monitor application in Harmony Industrial PC All Versions

HMIBMO HMIBMI HMIPSO HMIBMP HMIBMU HMIPSP HMIPEP

Schneider Electric System Monitor application in Pro-face Industrial PC All Versions

CVE-2024-8884

CWE-200: Information Exposure vulnerability exists that could cause exposure of credentials
when attacker has access to application on network over http.

CVE Description

Exposure of Sensitive Information to an Unauthorized Actor

Customer can uninstall System Monitor application using
installer available for download here:
https://www.se.com/ww/en/product-range/61054-
harmony-industrial-pc/#software-and-firmware
Customers should use appropriate patching methodologies when applying these patches to
their systems. We strongly recommend the use of back-ups and evaluating the impact of these
patches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch. Please follow the steps described in the guideline
attached as a .pdf in the downloaded uninstaller
guide. We strongly recommend the use of back-ups and evaluating the impact of this uninstaller in a
Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s
Customer Care Center if you need assistance.

Customer can uninstall System Monitor application using
installer available for download here:
https://www.proface.com/en/product/ipc/ps5000/download

Customers should use appropriate patching methodologies when applying these patches to
their systems. We strongly recommend the use of back-ups and evaluating the impact of these
patches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch. Please follow the steps described in the guideline
attached as a .pdf in the downloaded uninstaller
guide.We strongly recommend the use of back-ups and evaluating the impact of this uninstaller in a
Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s
Customer Care Center if you need assistance.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Stop the system monitor if not required by turning off the services as specified in user
guide:
o Harmony Industrial PC Series User Manual

• Setup network segmentation and implement a firewall to block all unauthorized access
to configured HTTP/HTTPS ports.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
• Stop the system monitor if not required by turning off the services as specified in user
guide:
Pro-face PS5000 legacy industrial PC Series User Manual

• Setup network segmentation and implement a firewall to block all unauthorized access
to configured HTTP/HTTPS ports.


EcoStruxure EV Charging Expert

Summary: Original Release

Summary: EcoStruxure EV Charging Expert - SEVD-2024-282-08 PDF Version

Summary: EcoStruxure EV Charging Expert - SEVD-2024-282-08 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure EV Charging Expert
(formerly known as EVlink Load Management System) product operating system (OS).
The EcoStruxure EV Charging Expert product is load management, access management and
supervision solution for EV charging infrastructure.
Failure to apply the mitigations provided below may risk in various attack scenarios due to
legacy OS component vulnerabilities which could result in operational failures.

Overview

Schneider Electric

EcoStruxure EV Charging Expert

Schneider Electric EcoStruxure EV Charging Expert versions prior to 6.0.0

Schneider Electric EcoStruxure EV Charging Expert version 6.0.0 and later

Vulnerability Details

The third-party Yocto Krogoth 2.1 Operating System is used in the EcoStruxure EV Charging
Expert product. It is known to contain multiple high and critical severity vulnerabilities.

Version 6.0.0 (and later) of the EcoStruxure EV
Charging Expert product includes a fix for these
vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/62159-
ecostruxure-ev-charging-expert/ - software-and-firmware
The installation procedure requires physical access to
the device and a reboot of the product to complete the
update.
After installation, the software version can be checked
through the operation interface in the Updates tab.


PowerLogic PM5300 Series

Summary: Original Release

Summary: PowerLogic PM5300 Series - SEVD-2024-317-01 PDF Version

Summary: PowerLogic PM5300 Series - SEVD-2024-317-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its PowerLogic PM5300 series with ethernet functionality.
PowerLogic PM5300 series offers a compact, versatile power meter for energy cost and basic network
management applications.
Failure to apply the remediation below may risk loss of communication to the device leading to a denial of
service.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0) https://www.first.org/cvss/calculator/4.0 . CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Overview

Note - PM5310 and PM5330 are not impacted because they use serial communication infrastructure and donot have an Ethernet stack.

Overview

Schneider Electric

PowerLogic PM5320

Schneider Electric PowerLogic PM5320 Version 2.3.8 and prior

PowerLogic PM5340

Schneider Electric PowerLogic PM5340 Version 2.3.8 and prior

PowerLogic PM5341

Schneider Electric PowerLogic PM5341 Version 2.6.6 and prior

PowerLogic PM5320

Schneider Electric PowerLogic PM5320 Version 2.4.0

PowerLogic PM5340

Schneider Electric PowerLogic PM5340 Version 2.4.0

PowerLogic PM5341

Schneider Electric PowerLogic PM5341 Version 2.7.0

CVE-2024-9409

CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become
unresponsive resulting in communication loss when a large amount of IGMP packets is present in the network.

CVE Description

Version 2.4.0 of PowerLogic PM5320 includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogicpm5340-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms

Version 2.4.0 of PowerLogic PM5340 includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogicpm5340-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms

Version 2.7.0 of PowerLogic PM5341 includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-ethernet-up-to31st-h-256k-2di-2do-35-alarms-mid/

If customers choose not to apply the remediation provided above, they should immediately apply the following
steps to reduce the risk of exploit:
1. Enable IGMP Snooping:
o Ensure that IGMP Snooping is enabled on the switch. This feature allows the switch to
intelligently forward multicast traffic only to the necessary ports where interested hosts reside. It
prevents unnecessary flooding of multicast traffic across all ports, thereby enhancing network
efficiency and minimizing unnecessary load on network resources.
2. Configure VLAN Interface Settings:
o Set up VLAN interface settings on the switch. It's important to have distinct configurations for
each VLAN to ensure proper IGMP operation.
3. Multicast Filtering:
o Use IGMP filtering to control the propagation of IGMP traffic through the network. This involves
configuring filters on a switch virtual interface (SVI), per-port, or per-port per-VLAN basis.
Multicast filtering helps manage IGMP snooping and controls multicast traffic forwarding
effectively.


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M340 / Momentum / MC80 / EcoStruxure™ Control Expert products. [Modicon PAC](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/?filter=business-1-industrial-automation-and-control) products control and monitor industrial operations. [EcoStruxure™ Control Expert](https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#overview) is the engineering application for Modicon Controllers. Failure to apply the provided remediations/mitigations below may risk unauthorized access to the controller, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Summary: Modicon Controllers M340 / Momentum / MC80 - SEVD-2024-317-02  PDF Version

Summary: Modicon Controllers M340 / Momentum / MC80 - SEVD-2024-317-02  CSAF Version

Modicon Controllers M340 / Momentum / MC80 & EcoStruxure™ Control Expert

Summary: Original Release

Summary:
EcoStruxure™ Control Expert is added as affected offer and remediations are
available for Modicon M340, EcoStruxure™ Control Expert, Modicon Momentum.

Schneider Electric

EcoStruxure™ Control Expert

EcoStruxure™ Control Expert Versions prior to 16.2 HF003

16.2 HF003

EcoStruxure™ Control Expert Version 16.2 HF003

Modicon M340 CPU Firmware Versions prior to SV3.70 installed on Modicon M340 CPU Controller (part numbers BMXP34*)

Modicon M340 CPU Firmware Versions since SV3.60 and prior to SV3.70 installed on Modicon M340 CPU Controller (part numbers BMXP34*)

Modicon M340 CPU Firmware Version SV3.70 installed on Modicon M340 CPU Controller (part numbers BMXP34*)

Modicon MC80 Firmware All Versions installed on Modicon MC80 Controller (part numbers BMKC80)

Modicon Momentum Unity M1E Processor Firmware Versions prior to SV2.90 installed on Modicon Momentum Unity M1E Processor Controller (171CBU*)

Modicon Momentum Unity M1E Processor Firmware Version SV2.90 installed on Modicon Momentum Unity M1E Processor Controller (171CBU*)

Modicon M340 CPU Firmware Versions prior to SV3.60 installed on Modicon M340 CPU Controller (part numbers BMXP34*)

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of
confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the
logical network while a valid user uploads or downloads a project file into the controller.

CVE Description

CVSS v4.0 Base Score 7.5 | High | [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

Firmware SV2.90 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/535-modicon-momentum/#software-and-firmware Important: Customer needs to use version of EcoStruxure™ Control Expert v16.2 HF003 minimum to connect with the latest version of Modicon Momentum.

EcoStruxure™ Control Expert V16.2 HF003 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#software-and-firmware

Version 3.70 of Modicon M340 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware

Customers should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP • Configure the Access Control List following the recommendations of the user manuals: “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/ • Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections. For more details refer to “Modicon Controller Systems Cybersecurity, User Guide”: https://www.se.com/ww/en/download/document/EIO0000001999/ • Ensure the M340 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controller Systems Cybersecurity, User Guide” chapter “Controler Memory Protection”:  https://www.se.com/ww/en/download/document/EIO0000001999/

Schneider Electric is establishing a remediation plan for all future versions of Modicon MC80 that will include a fix for CVE-2024-8933. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP  • Configure the Access Control List following the recommendations of the user manuals: “MC80 Programmable Logic Controller(PLC), User Manual” in the section “Access Control List (ACL)”: https://www.se.com/ww/en/download/document/EIO0000002071/    • Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections. For more details refer to “Modicon Controller Systems Cybersecurity, User Guide”: https://www.se.com/ww/en/download/document/EIO0000001999/

Customers should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP  • Configure the Access Control List following the recommendations of the user manuals: “Momentum for EcoStruxure™ Control Expert - 171CBU78090, 171CBU98090, 171CBU98091 Processors, User Guide” in the section “Controlling Access”: https://www.se.com/ww/en/download/document/HRB44124/ • Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections. For more details refer to “Modicon Controller Systems Cybersecurity, User Guide”: https://www.se.com/ww/en/download/document/EIO0000001999/

CVE-2024-8933

CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss
of confidentiality and integrity of controllers when conducting a Man-In-The-Middle attack between the
controller and the engineering workstation while a valid user is establishing a communication session. This
vulnerability is inherent to Diffie Hellman algorithm which does not protect against Man-In-The-Middle attacks.

CVE Description

CVSS v4.0 Base Score 7.7 | High | [CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N](https://www.first.org/cvss/calculator/4.0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N)

CVSS v4.0 Score

CVE-2024-8935


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M340 / Momentum / MC80 products.Modicon PAC control and monitor industrial operations.Failure to apply the provided remediations/mitigations below may risk unauthorized access to the controller, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.January 2026 Update: Remediation is now available for Modicon MC80.

Overview

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center if you need assistance removing a patch. If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit.

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Summary: Modicon Controllers M340 / Momentum / MC80 - SEVD-2024-317-03 PDF Version

Summary: Modicon Controllers M340 / Momentum / MC80 - SEVD-2024-317-03 CSAF Version

Summary: Original Release

Summary: A remediation is now available for Modicon Momentum Unity M1E Processor.

Summary: A remediation is now available for Modicon MC80. Enhancements for CSAF: Modified known affected, known-not-affected, and fixed products.

Schneider Electric

Modicon Momentum Unity M1E Processor

Modicon M340 CPU Firmware Versions prior to SV3.65 installed on Modicon M340 CPU Controller (part numbers BMXP34*)

Modicon M340 CPU Firmware SV3.65 installed on Modicon M340 CPU Controller (part numbers BMXP34*)

Modicon MC80 Firmware Versions prior to SV2.1 installed on Modicon MC80 Controller (part numbers BMKC80)

Modicon MC80 Firmware Version SV2.1 installed on Modicon MC80 Controller (part numbers BMKC80)

Modicon Momentum Unity M1E Processor Firmware Versions prior to SV2.80 installed on Modicon Momentum Unity M1E Processor Controller (171CBU*)

Modicon Momentum Unity M1E Processor Firmware Version SV2.80 installed on Modicon Momentum Unity M1E Processor Controller (171CBU*)

CWE-20: Improper Input Validation vulnerability exists that could lead to tampering a parameter
of the controller memory after a successful Man In The Middle attack followed by Read Physical
Memory operation leading to loss of confidentiality of controller memory.

CVE Description

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of
the user manuals: “Modicon M340 for Ethernet Communications
Modules and Processors User Manual” chapter “Messaging
Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/
• Consider use of external firewall devices such as EAGLE40-07 from
Belden to establish VPN connections. For more details refer to
“Modicon Controller Systems Cybersecurity, User Guide”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M340 CPU is running with the memory protection
activated by configuring the input bit to a physical input, for more
details refer to the following guideline “Modicon Controller Systems
Cybersecurity, User Guide” chapter “Controler Memory Protection”:
https://www.se.com/ww/en/download/document/EIO0000001999/

Version SV3.65 of Modicon M340 firmware includes a fix for these
vulnerabilities and is available for download here:
https://www.se.com/ww/en/product-range/1468- modicon-m340

CVE-2024-8936

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could cause potential arbitrary code execution after a successful Man In The Middle attack followed by sending crafted Modbus command to tamper with a function call
used for authentication process.

CVE Description

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP
• Configure the Access Control List following the recommendations of
the user manuals: “Modicon M340 for Ethernet Communications
Modules and Processors User Manual” chapter “Messaging
Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/
• Consider use of external firewall devices such as EAGLE40-07 from
Belden to establish VPN connections. For more details refer to
“Modicon Controller Systems Cybersecurity, User Guide”:
https://www.se.com/ww/en/download/document/EIO0000001999/
• Ensure the M340 CPU is running with the memory protection
activated by configuring the input bit to a physical input, for more
details refer to the following guideline “Modicon Controller Systems
Cybersecurity, User Guide” chapter “Controler Memory Protection”:
https://www.se.com/ww/en/download/document/EIO0000001999/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP  • Configure the Access Control List following the recommendations of the user manuals: “MC80 Programmable Logic Controller(PLC), User Manual” in the section “Access Control List (ACL)”: https://www.se.com/ww/en/download/document/EIO0000002071/    • Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections. For more details refer to “Modicon Controller Systems Cybersecurity, User Guide”: https://www.se.com/ww/en/download/document/EIO0000001999/

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP • Configure the Access Control List following the recommendations of the user manuals: “Momentum for EcoStruxure™ Control Expert -171CBU78090, 171CBU98090, 171CBU98091 Processors, User Guide” in the section “Controlling Access”:https://www.se.com/ww/en/download/document/HRB44124/• Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections. For more details refer to “Modicon Controller Systems Cybersecurity, User Guide”:https://www.se.com/ww/en/download/document/EIO0000001999/

Version SV2.80 of Modicon Momentum firmware includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-range/535-modicon-momentum

Version SV2.1 of Modicon MC80 firmware includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-range/62396-modicon-mc80

CVE-2024-8937

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could cause potential arbitrary code execution after a successful Man-In
-The Middle attack followed by sending crafted Modbus command in order to tamper with a
function call used to evaluate memory size.

CVE Description

CVE-2024-8938


EcoStruxure™ IT Gateway

Summary: Original Release

Summary: EcoStruxure™ IT Gateway - SEVD-2024-317-04 PDF Version

Summary: EcoStruxure™ IT Gateway - SEVD-2024-317-04 CSAF Version

Public

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its EcoStruxure™ IT Gateway.
The EcoStruxure™ IT Gateway is a component of the EcoStruxure™ IT platform, designed to
connect your IT infrastructure devices to the cloud. It collects data from these devices and
securely transmits it to the EcoStruxure™ IT platform for analysis and management.
Failure to apply the fix provided below may risk unauthorized access to EcoStruxure™ IT
Gateway which could result in control of the Gateway and/or retrieval of sensitive information.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0) https://www.first.org/cvss/calculator/4.0 . CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer's environment.

Overview

Customers should use appropriate methodologies when updating their systems. We strongly recommend the use of backups and evaluating the impact of the software update in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric's Customer Care Center if you need assistance.

Overview

Schneider Electric

EcoStruxure™ IT Gateway

Schneider Electric EcoStruxure™ IT Gateway Versions 1.21.0.6

Schneider Electric EcoStruxure™ IT Gateway Versions 1.22.0.3

Schneider Electric EcoStruxure™ IT Gateway Versions 1.22.1.5

Schneider Electric EcoStruxure™ IT Gateway Versions 1.23.0.4

Schneider Electric EcoStruxure™ IT Gateway 1.23.1.10

CVE-2024-10575

CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access
when enabled on the network and potentially impacting connected devices.

CVE Description

Version 1.23.1.10 of EcoStruxure™ IT Gateway includes a
fix for this vulnerability and is available for download here:
• https://community.se.com/t5/What-s-new-inEcoStruxure-IT/Download-the-EcoStruxure-ITGateway/ta-p/455022
• Instructions provided in the link above.
• We encourage customers to enable automatic
updates to receive updates promptly.
• Customers who have enabled automatic updates
do not need to take any further action.
Prior versions are not impacted by this vulnerability.

If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:
Customers should protect the Gateway from remote access by controlling access to the
software over a network. The following actions could be taken:
• Placing the Gateway software on protected access-controlled networks only
• Implementing a local firewall to deny remote access to the web API.
• Removing the Gateway software and installing a clean build of 1.23.1.10


PowerChute Serial Shutdown

Summary: Original Release

Summary: PowerChute Serial Shutdown - SEVD-2024-345-01 PDF Version

Summary: PowerChute Serial Shutdown - SEVD-2024-345-01 CSAF Version

Public

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its PowerChute Serial Shutdown product.
The PowerChute Serial Shutdown product is a UPS management software enabling graceful system shutdown
and energy management capabilities for desktop, servers and workstations.
Failure to apply the fix provided below may risk a Denial of Service attack, which could result in an attack that
blocks access for the single user account to PCSS Web UI. The PCSS application itself is not affected and
PCSS will keep protecting the server.

Overview

Schneider Electric

PowerChute Serial Shutdown

Schneider Electric PowerChute Serial Shutdown Versions v1.2.0.301 and prior

Schneider Electric PowerChute Serial Shutdown v1.3

CVE-2024-10511

CWE-287: Improper Authentication vulnerability exists that could cause Denial of access to the web interface
when someone on the local network repeatedly requests the /accessdenied URL.

CVE Description

Version 1.3 of PowerChute Serial Shutdown includes a fix for this
vulnerability and is available for download here:
https://www.apc.com/us/en/product-range/137943580-powerchute-serialshutdown/#software-and-firmware

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit:
• Do not enable remote access to PCSS Web UI. In the Windows Firewall incoming requests on TCP
port 6547 (used by PCSS) are not allowed by default.
• Harden the PowerChute Serial Shutdown Agent firewall rule by listing remote computers and/or users
for which you want to allow/block remote connections on TCP port 6547.
• Specific instructions for these mitigations can be found in the Security Handbook.


Harmony HMI and Pro-face HMI products

Summary: Original Release

Summary: Harmony HMI and Pro-face HMI products - SEVD-2024-345-02 PDF Version

Summary: Harmony HMI and Pro-face HMI products - SEVD-2024-345-02 CSAF Version

Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.
For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Harmony HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7
products used with EcoStruxure™ Operator Terminal Expert Software and PFXST6000, PFXSTM6000,
PFXSP5000, PFXGP4100 products used with Pro-face BLUE Software.
Harmony HMI Panels and Pro-face HMI Panels are the main visible automation component that manage all
vital machine features, including visualization, control, supervision, diagnostics, monitoring, and data logging.
Failure to apply the mitigations provided below may risk various attack scenarios due to Third-Party
Component obsolescence, which could result in complete loss of control, Integrity and Confidentiality of the
device and operational failure.

Overview

Schneider Electric

Harmony with EcoStruxureTM Operator Terminal Expert runtime

Schneider Electric Harmony (Formerly Magelis) HMIST6, HMISTM6, HMIG3U, HMIG3X, HMISTO7  series with EcoStruxureTM Operator Terminal Expert runtime All versions

Pro-face HMI with Pro-face BLUE runtime

Schneider Electric PFXST6000, PFXSTM6000, PFXSP5000, PFXGP4100 series with Pro-face BLUE runtime All versions

CVE-2024-11999

CWE-1104: Use of Unmaintained Third-Party Components exists that could cause complete control of the
device when an authenticated user installs malicious code into HMI product.

CVE Description

Use of Unmaintained Third Party Components

Customers should immediately apply the following mitigations to
reduce the risk of exploit:
• Use HMI only in a protected environment to minimize network
exposure and ensure that they are not accessible from public
internet or untrusted networks.
• Setup network segmentation and implement a firewall to block
all unauthorized access.
• Restrict usage of unverifiable portable media
• Restricting the application access to limit the transfer of
Firmware to HMIScanning of software/files for rootkits before
usage and verifying the digital signature.
• When exchanging files over the network, use secure
communication protocols.


Public

We strongly recommend the following industry cybersecurity best practices.

https://www.se.com/us/en/download/document/7EN52-0390/
* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

LEGAL DISCLAIMER

Schneider's purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and
sustainability for all. We call this Life Is On.

Our mission is to be the trusted partner in Sustainability and Efficiency.

We are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart
industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep
domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,
software and services, delivering digital twins to enable profitable growth for our customers.

We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries
to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our
meaningful purpose of a sustainable future for all.

 www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon M241 / M251 / M258 https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/ and Modicon LMC058 https://www.se.com/ww/en/product-range/7744-modicon-lmc058/
products.

The Modicon M241/M251/M258/LMC058 products are Programmable Logic Controllers for performance-demanding applications.

Failure to apply the Fix provided below may risk a denial of service and partial loss of Integrity of the controller,
which could result in disruption operations.

October 2025 Update: A remediation is now available for Modicon M258 / LMC058

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0-https://www.first.org/cvss/calculator/4.0). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment

Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric’s Customer Care Center (https://www.se.com/us/en/work/support/) if you need assistance removing a patch.

Summary: Modicon M241 / M251 / M258 / LMC058 - SEVD-2024-345-03 PDF Version

Summary: Modicon M241 / M251 / M258 / LMC058 - SEVD-2024-345-03 CSAF Version

Modicon M241 / M251 / M258 / LMC058

Summary: Original Release

Summary: A remediation is now available for Modicon M241 / M251.

Schneider Electric

Modicon Controllers M241

Schneider Electric Modicon Controllers M241 Versions prior to 5.2.11.29

Modicon Controllers M251

Schneider Electric Modicon Controllers M251 Versions prior to 5.2.11.29

Modicon Controllers M258

Modicon Controllers M258 Versions prior to v5.0.4.19

Modicon Controllers M258 Version v5.0.4.19

Modicon Controllers LMC058

Modicon Controllers LMC058 Versions prior to v5.0.4.19

Modicon Controllers LMC058 Version v5.0.4.19

Modicon Controllers M241

Schneider Electric Modicon Controllers M241 Version 5.2.11.29

Modicon Controllers M251

Schneider Electric Modicon Controllers M251 Version 5.2.11.29

Modicon Controllers M241 Version 5.2.11.29 installed on Modicon Controllers M241

Modicon Controllers M251 Version 5.2.11.29 installed on Modicon Controllers M251

Modicon Controllers M258 Version 5.0.4.19 installed on Modicon Controllers M258

Modicon Controllers LMC058 Version 5.0.4.19 installed on Modicon Controllers LMC058

CWE-20: Improper Input Validation vulnerability exists that could lead to a denial of service and a loss of
confidentiality, integrity of the controller when an unauthenticated crafted Modbus packet is sent to the device.

CVE Description

Modicon M241/M251 Firmware version 5.2.11.29 includes a fix for this
vulnerability and can be updated through the Schneider Electric Software
Update (SESU) application that is part of EcoStruxure™ Machine Expert:
https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/

By using Controller Assistant update Modicon Controller M241/M251 to the
latest Firmware and perform reboot.

Modicon M258/LMC058 Firmware version 5.0.4.19 includes a fix for this vulnerability and can be downloaded here: https://www.se.com/ww/en/product-range/2730-modicon-m258-compact-plc-for-machine-automation/#software-and-firmware
By using Controller Assistant from EcoStruxureTM Machine Expert update Modicon Controller M258/LMC058 and perform reboot.

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of ex

* Use controllers and devices only in a protected environment to
minimize network exposure and ensure that they are not
accessible from public internet or untrusted networks.
* Filter ports and IP through the embedded firewall.
* Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP.
* Disable all unused protocols (default configuration).
* For more details refer to “Cybersecurity Guidelines for
EcoStruxure Machine Expert, Modicon and PacDrive Controllers
and Associated Equipment User Guide”:
https://www.se.com/ww/en/download/document/EIO0000004242/

CVE-2024-11737


Public

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit the company’s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.

We provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.

We are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.

www.se.com

About Schneider Electric

Schneider Electric is aware of a vulnerability in its Modicon M580 PLCs (Programmable Logic Controllers) https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/?parent-subcategory-id=3950&filter=business-1-industrial-automation-and-control#products ,
BMENOR2200H https://www.se.com/ww/en/product/BMENOR2200H/modicon-x80-module-coupleur-rtu-%C3%A9volu%C3%A9-sur-ethernet-1-port-s%C3%A9rie-durci/  and EVLink Pro AC https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#products  products.
Modicon M580 PLCs https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/?filter=business-1-industrial-automation-and-control  control and monitor industrial operations.
BMENOR2200H https://www.se.com/ww/en/product/BMENOR2200H/modicon-x80-module-coupleur-rtu-%C3%A9volu%C3%A9-sur-ethernet-1-port-s%C3%A9rie-durci/  is an advanced RTU communication module for Modicon M580 PLCs.
EVLink Pro AC https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#products  is a 3rd generation of AC charging station.
Failure to apply the fix or mitigations provided below may risk buffer overflow attack, which could result in
Denial-of-Service.

Overview

Summary: Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC - SEVD-2025-014-01 PDF Version

Summary: Modicon M580 PLCs, BMENOR2200H and EVLink Pro AC - SEVD-2025-014-01 CSAF Version

Summary: Original Release

Summary: A remediation is now available for BMENOR2200H.

Schneider Electric

Schneider Electric Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) Versions prior to SV4.30

Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions prior to SV4.21

Schneider Electric BMENOR2200H Versions prior to SV4.02.01

Schneider Electric BMENOR2200H Version SV4.02.01

EVLink Pro AC

Schneider Electric EVLink Pro AC Versions prior to v1.3.10

Schneider Electric EVLink Pro AC V1.3.10

CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the
product when an unauthenticated user is sending a crafted HTTPS packet to the webserver.

CVE Description

SV4.30 of Modicon M580 firmware includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware

SV4.21 of Modicon M580 firmware includes a fix for this vulnerability and is
available for download here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware

SV4.02.01 of BMENOR2200H firmware includes a fix for this vulnerability and
 is available here:
https://www.se.com/ww/en/product/BMENOR2200H/communication-module-modicon-m580-iec-608705101-104-dnp3-for-severe-environments/

V1.3.10 of EVLink Pro AC firmware includes a fix for this vulnerability and is
available here:
https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#software-and-firmware

• Setup network segmentation and implement a firewall to block all unauthorized
access to port 443/TCP
• Configure the Access Control List following the recommendations of the user
manuals: “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO0000001578/

If customers choose not to apply the remediation provided above, they should immediately apply the following
mitigations to reduce the risk of exploit.• Setup network segmentation and implement a firewall to block all unauthorized
access to port 443/TCP

• Follow EVlink Pro AC cybersecurity guide
https://www.se.com/ww/en/download/document/GEX5261101/

CVE-2024-11425


Public

We strongly recommend the following industry cybersecurity best practices.

* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.
* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.
* Place all controllers in locked cabinets and never leave them in the “Program” mode.
* Never connect programming software to any network other than the network intended for that device.
* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.
* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.
* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.
* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.

For more information refer to the Schneider Electric [Recommended Cybersecurity Best Practices](https://www.se.com/us/en/download/document/7EN52-0390/) document.

General Security Recommendations

This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.

For further information related to cybersecurity in Schneider Electric's products, visit the company's cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

For More Information

LEGAL DISCLAIMER

About Schneider Electric

Schneider Electric is aware of multiple vulnerabilities in its Pro-face GP-Pro EX and Remote HMI products.

The Pro-face [GP-Pro EX](https://www.proface.com/en/product/soft/gpproex/top) product is HMI Screen Editor & Logic Programming Software.

The Pro-face [Remote HMI](https://www.proface.com/en/product/soft/remotehmi/top) product is a remote monitoring software for mobile and allows you to check
equipment information on a tablet or smartphone.

Failure to apply the mitigations provided below may risk Man-in-the-Middle attacks which could result in
information disclosure, integrity issues and operational failures.

Overview

The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 ([CVSS v4.0](https://www.first.org/cvss/calculator/4.0)). CVSS v3.1
will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without
incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score
the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as
the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed
by the vulnerabilities described in this document within a customer’s environment.

Customers should use appropriate patching methodologies when applying these patches to their systems. We
strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and
Development environment or on an offline infrastructure. Contact Schneider Electric's [Customer Care Center](https://www.se.com/us/en/work/support/contacts.jsp) if you need assistance removing a patch.

Summary: Pro-face GP-Pro EX and Remote HMI - SEVD-2025-014-02 PDF Version

Summary: Pro-face GP-Pro EX and Remote HMI - SEVD-2025-014-02 CSAF Version

Pro-face GP-Pro EX and Remote HMI

Summary: Original Release

Summary: Remediations are now available for Pro-face GP-Pro EX and Pro-face Remote HMI.

Schneider Electric

Pro-face

GP-Pro EX

Schneider Electric Pro-face GP-Pro EX Versions prior to 5.00.100

Schneider Electric Pro-face GP-Pro EX Version 5.00.100

Remote HMI

Schneider Electric Pro-face Remote HMI Versions prior to 1.70.000

Schneider Electric Pro-face Remote HMI Version 1.70.000

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the
HMI when attacker performs man in the middle attack by intercepting the communication.

CVE Description

Version 5.00.100 release of GP-ProEX includes a fix for this vulnerability. Please contact your [Pro-face Customer Care Center](https://www.proface.com/en/contact) to obtain the fix.

Version 1.70.000 of Pro-face Remote HMI includes a fix for this vulnerability and is available for download in [Apple App Store](https://apps.apple.com/) and [Google Play Store](https://play.google.com/).

If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:

For customers requiring the use of Pro-face Remote HMI, Schneider Electric recommends using following mitigations:

* Use of [Pro-face Connect solution](https://www.proface.com/en/product/soft/proface_connect/top) or any other VPN solutions for securing the remote access by encrypting the communication between Pro-face Remote HMI and Pro-face GP-ProEX.

* Always connect the products to only trusted networks and follow the [Pro-face Cybersecurity Guidelines](https://www.proface.com/en/download/manual/cybersecurity_guide)

* Set up a connection password. For more details refer to the [GP-Pro EX V4.0 Reference Manual](https://www.pro-face.com/otasuke/files/manual/gpproex/new/refer/gpproex.htm#t=mergedProjects%2Fremote%2Fremote_sg_remotehmi.htm&rhsearch=Remote%20HMI&rhhlterm=Remote%20HMI&ux=search) in section “Remote Viewer - Pro-face Remote HMI”

For customers not using the Pro-face Remote HMI Schneider Electric recommends using following mitigations to reduce the risk of exploit:

* Disable the Pro-face Remote HMI feature (deactivated by default). For more details refer to the [GP-Pro EX V4.0 Reference Manual](https://www.pro-face.com/otasuke/files/manual/gpproex/new/refer/gpproex.htm#t=mergedProjects%2Fmaintenance%2Fmaintenance_sg_remotemonitor.htm%23BMK_ProfaceRemoteHMI&rhsearch=Remote%20HMI) section “Pro-face Remote HMI Settings”

CVE-2024-12399