Summary
Schneider Electric is aware of the vulnerabilities impacting Apache Log4j, including CVE-2021-44228, also known as Log4Shell. Our cybersecurity team is actively investigating the impact of the vulnerability on Schneider Electric offers and will continuously update this notification as information becomes available.
In the meantime, customers should immediately ensure they have implemented cybersecurity best practices across their operations to protect themselves from exploitation of this vulnerability. Where appropriate, this includes locating their systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; and following the recommended mitigations and general security recommendations below.
Please subscribe to the Schneider Electric security notification service to be informed of critical updates to this notification, including information on affected products and remediation plans:
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
For additional information and support, please contact your Schneider Electric sales or service representative or Schneider Electric’s Customer Care Center.
August 2022 Update: Remediation update for Eurotherm Data Reviewer.
Vulnerabilities 5
-
Critical 10.0
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who …
KEV Dec 10, 2021 -
Critical 9.0
Apache Log4j2 Thread Context Message Pattern and Context Lookup Pattern vulnerable to a denial of service attack
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-defaul…
KEV May 1, 2023 -
High 7.5
Deserialization of untrusted data in JMSAppender in Apache Log4j 1.2
JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. The attacker can provide TopicBindingName and TopicConnectionFactoryBindingName configurations causing JMSAppender to pe…
-
Medium 6.6
Apache Log4j2 vulnerable to RCE via JDBC Appender when attacker controls configuration
Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has control o…
-
Medium 5.9
Apache Log4j2 does not always protect from infinite recursion in lookup evaluation
Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups. This allows an attacker with control over Thread Context Map data to cause a denial of service when a craf…
Revision history
-
#14.0.0
A remediation is now available for Netbotz 750/755
-
#13.0.0
Remediation update for Eurotherm Data Reviewer.
-
#12.0.0
Remediation update for Workplace Advisor.
-
#11.0.0
Remediation available for APC PowerChute Business Edition, APC PowerChute Network Edition, and EMA Server.
-
#10.0.0
Netbotz remediation updated due to stability issue on version 5.3.1.
-
#9.0.0
Remediations updated for EcoStruxure™ IT Gateway & EcoStruxure™ IT Expert to address CVE-2021-45105.
-
#8.1.0
Added CVE-2021-44832 to the scope of this security notification (page 1)
-
#8.0.0
Added TwinBus IP (formerly Digides 2.0) and Select and Config DATA to list available remediations. (page 3 and 4)
-
#6.0.0
-Updated information for Facility Expert SmallBusiness and Wiser by SE Platform in availableremediations section (page 3) -Workplace Advisor added to list of affectedoffers (page 7)
-
#7.0.0
-Updated information for Facility Expert SmallBusiness and Wiser by SE Platform and addedHarmony Configurator, MSE, NetBotz750/755,SDK-Docgen, SDK-UMS, SNC-API, SNC-CMM,SNC-SEMTECH to list available remediations.(page 3-4) -Upon further investigation the following productshave been determined to not be affected by theLog4j vulnerabilities and have been removedfrom the list of affected offers: EASYFIT,Ecoreal XL, NEW630, SDK BOM, SDK-TNC ,SDK3D-2DRenderer, SDK3D-360Widget,SPIMV3, SWBEditor, SWBEngine
-
#5.0.0
CVE-2021-4104 added to the scope of this security notification.
-
#4.0.0
Overview updated to include CVE-2021-45046, Facility Expert Small Business and Wiser by SE platform added to list of available remediations, EASYFIT, Ecoreal XL, Eurotherm Data Reviewer, MSE, NetBotz750/75, NEW630, SDK BOM, SDK-Docgen, SDK-TNC, SDK-UMS, SDK3D-2DRenderer, SDK3D-360Widget, SNC-API, SNC-CMM, SNC-SEMTECH, SPIMV3, SWBEditor, SWBEngine added to list of affected products.
-
#3.0.0
APC PowerChute Business Edition and APC PowerChute Network Shutdown added to affected products section
-
#2.0.0
EcoStruxure™ IT Gateway and EcoStruxure™ IT Expert added to available remediations section
-
#1.0.0
Original Release
References
-
Apache Log4j Vulnerabilities (Log4Shell) - SESB-2021-347-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SESB-2021-347-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SESB-2021-347-01_Apache_Log4j_Log4Shell_Vulnerabilities_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/