Summary
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxureTM Foxboro DCS product formerly known as Foxboro Evo Process Automation System and I/A Series.
The DCS component impacted is the Control Core Services package.
The EcoStruxureTM Foxboro DCS product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation.
Failure to apply the remediations provided below may risk denial of service, privilege escalation, and kernel code execution, which could result in loss of system functionality or unauthorized access to system functions
Vulnerabilities 2
-
High 7.8
A CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, elevation of privilege, a…
-
High 7.0
A CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service, and potent…
Revision history
-
#1
Original Release
References
-
EcoStruxureTM Foxboro DCS Control Core Services - SEVD-2023-164-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-164-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-164-04.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/