A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior)

A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior)

Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert, EcoStruxure™ Process Expert, SCADAPack RemoteConnect™ for x70 software products. EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon M340, M580, M580S, Premium, Momentum and Quantum ranges. EcoStruxure™ Process Expert is the next-generation process automation system to engineer, operate and maintain an entire plant, a Distributed Control System (DCS), designed especially for water, mining, cement, power generation, consumer packaged goods, chemical, and oil and gas applications. The SCADAPack RemoteConnect™ for x70 product is a Windows-based application based on EcoStruxure™ Control Expert software components that provides a programming and configuration environment for the SCADAPack x70 RTU series, which is comprised of the SCADAPack 470, 474, 570, 574 and 575 Smart RTUs. Failure to apply the remediations provided below may risk a Denial of Service attack, which could cause a disruption of communication between the Modicon controller and the engineering software. June 2022 Update: Added SCADAPack RemoteConnect™ to the list of affected products, which is impacted on versions prior to R2.7.3 through the integration of EcoStruxure™ Control Expert.