Skip to content
OpenAdvisories
Critical SEVD-2022-221-01 1 CVE

EcoStruxureTM Control Expert, EcoStruxureTM Process Expert, and Modicon Controllers M580 and M340

Published Aug 9, 2022 · Updated Aug 13, 2024 · Revision 6

Vendor: Schneider Electric Product: EcoStruxure Control Expert Product: EcoStruxure™ Process Expert Product: Modicon M340 CPU Product: Modicon M580 CPU Product: Modicon M580 CPU Safety Product: Modicon M580 CPU Safety <SV4.10

Summary

Schneider Electric is aware of a vulnerability in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert, and Modicon M580 and M340 control products.
Failure to apply the remediations provided below may risk a bypass of access controls in place, which could result in the possibility of arbitrary code execution and loss of confidentiality and integrity of the project file.
March 2023 Update: Remediation for the Modicon M580 CPU is available for download

Vulnerabilities 1

Revision history

  1. #5.0.0

    A remediation is available for the Modicon M580 CPU Safety (page 2)

  2. #4.0.0

    Remediation for the Modicon M580 CPU is available for download

  3. #3.0.0

    The Modicon M580 SV4.02 firmware has been retracted for quality issues and is no longer available for download. Additional mitigations have been introduced for Modicon M580 CPU and M580 CPU Safety, and we urge customers to deploy these mitigations to further reduce the risk of potential exploitation of identified vulnerabilities.

  4. #2.0.0

    A clarification was added to the list of affected products by splitting Modicon M580 and Modicon M580 Safety CPU ranges. The purpose of the notification update is to inform customers that the latest fix Modicon M580 V4.02 does not apply to the Safety range of M580. It is highly recommended that customers using Modicon M580 Safety ranges continue to implement the mitigations shared in this document

  5. #1.1.0

    The version number for Modicon M580 that addresses these vulnerabilities has been updated from V4.01 to V4.02.

  6. #1.0.0

    Original Release

References