A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to exploit the component.

A CWE-1103: Use of Platform-Dependent Third Party Components with vulnerabilities vulnerability exists in Easergy T300 (Firmware version 1.5.2 and older) which could allow an attacker to exploit the component.

Researchers from Rostelecom-Solar have made Schneider Electric aware of multiple vulnerabilities affecting the company’s Easergy T300 product. Schneider Electric has worked closely with the researchers to remediate the vulnerabilities. We appreciate their collaboration and commitment to transparency. The vulnerabilities have been remediated via a free firmware update, which is available immediately by contacting Schneider Electric’s Customer Care Center. Access to the customer’s network is required for the majority of the disclosed vulnerabilities to be exploited. Therefore, if the customer’s network is well protected and monitored for intrusion, and care is taken to obtain software updates from a trusted source, the general risk of exploitation can be substantially minimized. Schneider Electric encourages customers to upgrade to the new firmware as soon as possible. The company further encourages customers to ensure any firmware files used to update the device are acquired from trusted sources; to operate the products on properly segmented control networks; to adequately secure any workstation that has been configured to have access to the product; and to follow the remediation and general security recommendations below. T300 is a grid automation platform that is typically deployed to medium voltage (2400-69000 VAC) substation cabinets.