Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert, Modicon M340, Momentum, MC80, M580 and M580 CPU Safety. The Modicon M580 are PAC and Safety PLCs with built-in Ethernet for process, high availability & safety solutions. The Modicon M340 offers compactness, flexibility, scalability, and robustness for the process industry and a wide range of demanding automation applications. The Modicon MC80 provides optimized operation, withstanding extreme conditions with high reliability and performance. The Modicon Momentum supports control and distributed I/O system with 4 fundamental components that easily snap together in various combinations to form versatile control systems or sub-systems. EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers). Failure to apply the mitigations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality and integrity of the controller.
Vulnerabilities 1
-
High 8.1
A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause execution of unauthorized Modb…
Revision history
-
#7.0.0
Remediations are available for Modicon MC80
-
#6.0.0
Remediations are available for EcoStruxure Control Expert, Modicon Momentum, and Modicon M340.
-
#5.0.0
A remediation is available for Modicon M580 CPU Safety(page 2).
-
#4.0.0
A remediation is available for Modicon M580
-
#3.0.0
All versions of the EcoStruxure™ Process Expert are impacted by this vulnerability
-
#2.0.0
Modicon Momentum Unity M1E Process (page 6) and Modicon MC80 were added to the impacted products with the mitigations (page 7).
-
#1.0.0
Original Release
References
-
EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and Modicon M340, M580 and M580 CPU Safety - SEVD-2023-010-06 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/7EN52-0390/