Modicon Controllers, EcoStruxure™ Control Expert and Unity Pro Programming Software

Researchers from Airbus Cybersecurity have made Schneider Electric aware of a vulnerability
in two versions of Schneider Electric's Modicon programmable controllers and its EcoStruxure
Control Expert (formerly Unity Pro) programming software.
Since alerting us to the vulnerability, Airbus Cybersecurity and Schneider Electric have
collaborated to validate the research and to assess its true impact. Our mutual findings
demonstrate that while the discovered vulnerability affects Schneider Electric offers, it equally
impacts many other vendors and the global industrial automation market in general, especially
when the baseline assumption of the attack technique Airbus Cybersecurity demonstrated is
considered. Given certain conditions, and assuming an attacker has access to the network,
many devices available from several different industrial control vendors are likewise vulnerable.
Details of the vulnerability and a remediation are included below. However, as a general
guideline, Schneider Electric and Airbus Cybersecurity encourage all industrial companies to
ensure they have implemented cybersecurity best practices across their operations and supply
chains to reduce cyber risks. Where appropriate this includes locating industrial systems and
remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized
access; preventing mission-critical systems and devices from being accessed from outside
networks; systematically applying security patches and activating antivirus software; and
applying whitelisting solutions.
For more detail on Airbus Cybersecurity's research, please visit their blog https://airbus-cyber-security.com/blog/ .
May 2021 Remediation Update: Customers on EcoStruxure™ Control Expert versions prior to
V15.0 are recommended to upgrade to remediate CVE-2020-7475.