Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxureTM Foxboro DCS product.
The EcoStruxureTM Foxboro DCS product is an innovative family of fault-tolerant, highly
available control components, which consolidates critical information and elevates staff
capabilities to ensure flawless, continuous plant operation.
Failure to apply the remediations provided below may risk local attacks from an authenticated
user on the workstation running Foxboro DCS Core Control Services, which could result in loss
of system functionality or unauthorized access to system functions.
Vulnerabilities 3
-
High 7.8
CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, …
-
High 7.1
CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when …
-
High 7.1
CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malici…
Revision history
-
#1.0.0
Original Release
References
-
EcoStruxureTM Foxboro DCS Core Control Services - SEVD-2024-191-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-191-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2024-191-02.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-24-345-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-345-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B