Skip to content
OpenAdvisories
High SEVD-2023-010-05 1 CVE

EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers)

Published Jan 10, 2023 · Updated Aug 13, 2024 · Revision 6

Vendor: Schneider Electric Product: EcoStruxure Control Expert Product: EcoStruxure™ Process Expert Product: Legacy Modicon Premium CPUs Product: Legacy Modicon Quantum CPUs Product: Modicon M340 CPU Product: Modicon M580 CPU Product: Modicon M580 CPU Safety Product: Modicon MC80 Product: Modicon Momentum Unity M1E Processor

Summary

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert and Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers).
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way.
EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers).
The EcoStruxure™ Process Expert DCS is a single automation system to engineer, operate, and maintain your entire infrastructure for a sustainable, productive and market-agile plant.
Failure to apply the mitigations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.
March 2023 Update: Remediation for EcoStruxure™ Control Expert, Modicon M580 CPU, and Momentum Unity M1E Processor are available for download (page 2). Additional mitigations for Modicon M340 were added.

Vulnerabilities 1

Revision history

  1. #6.0.0

    A remediation is available for the Modicon M580 CPU Safety (page 2).

  2. #5.0.0

    All versions of the EcoStruxure™ Process Expert are impacted by this vulnerability

  3. #4.0.0

    A remediation for Modicon MC80 is available for download

  4. #3.0.0

    A remediation for Modicon M340 is available for download. The qualitative severity rating of this vulnerability was corrected to “high” to reflect the CVSS Base score.

  5. #2.0.0

    Remediation for EcoStruxure™ Control Expert, Modicon M580 CPU, and Momentum Unity M1E Processor are available for download (page 2). Additional mitigations for Modicon M340 were added.

  6. #1.0.0

    Original Release

References