Skip to content
OpenAdvisories
Unscored SESB-2019-214-01 0 CVEs

Wind River VxWorks Vulnerabilities (URGENT/11)

Published Aug 2, 2019 · Updated Sep 13, 2022 · Revision 20

Vendor: Schneider Electric Product: CANopen X80 Communication Module (BMECXM0100) Product: ConneXium Industrial Firewall Product: ConneXium Industrial Firewall/Router Product: ConneXium Industrial Firewall/Router - TCSEFEC2CF3F21(MM/TX) - TCSEFEC23FCF21 (TX/MM) - TCSEFEC23F3F21 (TX/TX) Product: E+PLC100 Combination PLC Product: E+PLC400 Combination PLC Product: Easergy MiCOM C264 [For PACiS (ESO) 5.2] Product: Easergy MiCOM C264 [For PACiS (ESO) 6.1] Product: Easergy MiCOM C264 [For PACiS (ESO) 6.3] Product: Easergy MiCOM P30 Product: Easergy MiCOM P30 with rejuvenated Ethernet board CORTEC Product: Easergy MiCOM Px40 Product: Easergy P5 Product: Easergy T300 (SC150 & LV150) Product: GP-ProEX Product: GP4000E Series Product: GP4000H/R/E Series Product: GP4100 Compact Series Product: HMIGTO Series Product: HMIGTU Series Product: HMIGTU Series - Open Box Product: HMIGTUX Series Product: HMIGXU Product: HMISCU Series Product: IEC 61850 communication module BMENOP0300 Product: ION7400 Product: ION7400 MID (METSEION74001) Product: ION9000 Product: LT4000M Modular Series +41 more

Summary

Wind River's VxWorks TCP/IP Stack vulnerabilities have wide-ranging impact across multiple IT and
industrial applications. We are working closely with Wind River to understand and assess how these
vulnerabilities impact Schneider Electric offers and our customers’ operations. We downloaded Wind
River’s patches as soon as they were made available to us, and we have quickly instituted a
remediation plan to evolve all current and future products that rely on the Wind River platform to
embed these fixes.
We will continue to monitor and will respond further if new information becomes available. In the
meantime, customers should immediately make sure they have implemented cybersecurity best
practices across their operations to protect themselves from these vulnerabilities. Where appropriate
this includes locating your industrial systems and remotely accessible devices behind firewalls;
installing physical controls to prevent unauthorized access; and preventing mission-critical systems
and devices from being accessed from outside networks.
Please subscribe to the Schneider Electric security notification service to be informed of updates to
this disclosure, including details on affected products and remediations, as well as other important
security notifications:
https://www.schneider-electric.com/en/work/support/cybersecurity/security-notifications.jsp
For additional information and support, please contact your Schneider Electric sales or service
representative or Schneider Electric’s Customer Care Center.
Note: Schneider Electric is aware of a potential exploit available that targets the URGENT/11
vulnerabilities. Our customers should urgently consider applying the remediations or mitigations
detailed in this document.
September 2022 Update: CANopen X80 Communication Module (BMECXM0100) (page 2) and
Profibus Remote Master (TCSEGPA23F14F) (page 7) added to the list of affected products, along
with their final mitigations.

Revision history

  1. #2.14.0

    CANopen X80 Communication Module (BMECXM0100) (page 2) and Profibus Remote Master (TCSEGPA23F14F) (page 7) added to the list of affected products, along with their final mitigations.

  2. #2.13.0

    Updated remediations for Modicon M241 Micro PLC and Modicon M251 Micro PLC.

  3. #2.12.0

    Updated remediations for versadac™ Scalable Data Recorder, E+PLC100 Combination PLC, and E+PLC400 Combination PLC products.

  4. #2.11.0

    Updated remediations for Easergy T300 and Magelis HMI - HMIGTO Series, HMISCU Series, HMIGTUX Series, and HMIGTU Series (Except Open BOX) products.

  5. #2.10.0

    Clarified “Affected Version” and “Remediation” version reference numbers for SCD6000 Industrial RTU product.

  6. #2.9.0

    Updated remediations for Modicon Network Option Switch, Modicon X80 - I/O Drop Adapters, Modicon Quantum 140 CRA, Modicon Quantum Head 140 CRP, and Modicon Quantum Ethernet DIO network module - 140NOC78x00 (C), SCD6000 Industrial RTU, Pro-face HMI -GP4000H/R/E Series.

  7. #2.8.0

    Updated remediations for ION7400 MID and PM8000 MID.

  8. #2.7.0

    Updated remediations for HMIGXU, Easergy MiCOM P30, Tricon Communication Modules, Trident Communication Integration Module.

  9. #2.6.0

    Updated remediations for Modicon LMC078 Controller, Modicon M580 Ethernet communications Modules: Modicon M580 IEC 61850 - BMENOP0300 (C), Modicon MC80 Programmable Logic Controller, Modicon Quantum 140 NOP Communications Module, PacDrive 3 Eco/Pro/Pro2 Motion Controllers, Pro-face HMI -GP4000H/R/E Series, GP4100 Compact Series, LT4000M Modular Series, GP4000E Series, IoT Gateway, SP5000 Series, and SP5000X Series, Easergy MiCOM Px40, and TeSys island.

  10. #2.5.0

    Updated remediations for Modicon X80 I/O modules, Modicon Momentum Unity, Nanodac Recorder / Controller (added to affected products), SCADAPack 53xE RTUs, and Saitel DR with HU_A CPU.

  11. #2.4.0

    Updated remediations for Modicon M580 Ethernet Communications Modules, Modicon M580 ePAC CPUs including Safety CPUs, Easergy P5, ION7400, ION9000, PM8000.

  12. #2.3.0

    Updated remediations for Modicon M262 Logic/Motion Controller (page 3)

  13. #2.2.0

    Updated remediations for ConneXium Industrial Firewall, Easergy MiCOM C264 Controller (page 2-3) Enhanced product list with additional details for Modicon X80 I/O modules. Added Modicon Quantum Head 140 CRP, Modicon Momentum Unity, and removed TMSES4 Ethernet Module from affected products.

  14. #2.1.0

    Updated affected versions for SCADAPack 57x RTUs and SAGE RTU under Available Remediations.

  15. #2.0.0

    - Exploit information added to Overview Section - Remediations added for SAGE RTU, Easergy MiCOM C264, and SCADAPack 57x RTUs - Updated affected versions for Easergy MiCOM P40

  16. #1.4.0

    Updated affected versions for Easergy MiCOM C264 product.

  17. #1.3.0

    Removed Modicon M580 Ethernet / Serial RTU Module and added Modicon eX80 - BMEAHI0812 HART Analog Input Module to list of affected products.

  18. #1.2.0

    Added SAGE RTU to list of affected products.

  19. #1.1.0

    Added Modicon LMC078 Controller to list of affected products, and removed a duplicate product.

  20. #1.0.0

    Original Release

References