Summary
Schneider Electric is aware of a vulnerability in the Harmony (formerly known as Magelis) HMI Panel products. Harmony HMI Panels are the main visible automation component that manage all vital machine features, including visualization, control, supervision, diagnostics, monitoring, and data logging.
Failure to apply the mitigations/remediations provided below may risk a temporary Denial of Service.
January 2024 Update: A fix is available for HMISCU series.
Vulnerabilities 1
-
Medium 6.5
A CWE-754 – Improper Check for Unusual or Exceptional Conditions vulnerability exists in Magelis HMI Panels (all versio…
Revision history
-
#4
A fix is available for Harmony/Magelis HMISCU
-
#3
A fix is available for Harmony/Magelis HMIGTO series, Harmony/Magelis, HMIGTU series, Harmony/Magelis HMIGTUX series, Harmony/Magelis HMIGK series and mitigations were added to reduce the risk of exploit for the remaining affected products.
-
#2
Updated Remediation and Acknowledgement sections
-
#1
Original Release
References
-
Harmony (formerly known as Magelis) HMI Panels - SEVD-2019-225-01 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-225-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2019-225-01_Harmony_Magelis_HMI_Panels_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://download.schneider-electric.com/files?p_Doc_Ref=7EN52-0390&p_enDocType=White+Paper&p_File_Name=Cybersecurity_Best+Practices_EN.pdf