Schneider Electric is aware of a vulnerability in its SAGE RTU products. The SAGE RTU products are a line of devices designed for substation data acquisition and control. Failure to apply the mitigations provided below may enable a privileged user to install maliciously modified firmware on a SAGE RTU during an upgrade operation, resulting in modified device behavior.
Schneider Electric is aware of multiple vulnerabilities in its Pro-face STW6000 and Harmony STW6 products. The Pro-face STW6000 and Harmony STW6 products are Basic Web HMI panels belongs to the Schneider Electric Harmony ST6 and Pro-face ST6000 range and is designed to meet the needs of simple machine operators for good visualization, connectivity, and cost-effective equipment. Failure to apply the mitigations provided below may risk various attack scenarios due to Third-party component obsolescence, which could result in unauthorized control to the device and operational failures.
Schneider Electric is aware of a vulnerability in its [ATVdPAC module](http://www.se.com/ww/en/product/VW3A3530D/atv-dpac-module/) / [ATV6000 Medium Voltage Altivar Process Drives](http://www.se.com/ww/en/product-range/65607-altivar-process-atv6000) / [ATV630/650/660/680/6A0/6B0/6L0 Altivar Process Drives](http://www.se.com/ww/en/product-range/62317-altivar-process-atv600) / [ATV930/950/955/960/980/9A0/9B0/9L0 Altivar Process Drives](http://www.se.com/ww/en/product-range/63124-altivar-process-atv900) / [ATV340E Altivar Machine Drives](http://www.se.com/ww/en/product-range/63441-altivar-machine-atv340#products) /[ATS490 Altivar Soft Starter](http://www.se.com/ww/en/product-range/213421154-altivar-soft-starter-ats490) / [Altivar Process Communication Modules](http://www.se.com/ww/en/product-range/62317-altivar-process-atv600/117623851529-modular-drives-apm) product(s).
Failure to apply remediation mitigations provided below may risk Cross-Site Scripting, which could result in partial loss of confidentiality and integrity of the workstation running a Web browser.
Schneider Electric is aware of a vulnerability in its Modicon M580 and Modicon M580 Safety controllers. The Modicon M580 is an Ethernet-based Programmable Automation Controller (ePAC) designed for industrial digital transformation. Failure to apply the remediations provided below may risk establishing an unauthenticated connection to Modicon M580 or M580 Safety controllers which could result in loss of confidentiality, integrity and availability of the PLC.
Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Failure to apply the mitigations provided below may increase the risk of unauthorized access to RTU configuration through the Secure Lock functionality, potentially resulting in a loss of confidentiality.
Schneider Electric is aware of a vulnerability in the Head Unit (HU250) for the PowerLogic T300 RTU (Remote Terminal Unit) (formerly Easergy T300 RTU). The [PowerLogic T300 RTU](https://www.se.com/ww/en/product-range/62399-easergy-t300) is a modular platform for medium voltage and low voltage public distribution network management. Failure to apply the remediation provided below may risk privilege escalation, which could result in unauthorized takeover of the device.
Schneider Electric is aware of its vulnerability in its EcoStruxure IT Data Center Expert product The EcoStruxure IT Data Center Expert product is a scalable monitoring software that collects, organizes,and distributes critical device information providing a comprehensive view of equipment. Failure to apply the remediation provided below may risk information disclosure and remote compromise of the offer which could result in disruption of operations and access to system data.
Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M340 / Momentum / MC80 / EcoStruxure™ Control Expert products. [Modicon PAC](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/?filter=business-1-industrial-automation-and-control) products control and monitor industrial operations. [EcoStruxure™ Control Expert](https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#overview) is the engineering application for Modicon Controllers. Failure to apply the provided remediations/mitigations below may risk unauthorized access to the controller, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert and Modicon M340, M580 PLCs (Programmable Logic Controllers). Modicon PLCs control and monitor industrial operations. EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs. EcoStruxure™ Process Expert DCS is a single automation system to engineer, operate, and maintain an entire plant Infrastructure. Failure to apply the remediations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller. Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert, Modicon M340, Momentum, MC80, M580 and M580 CPU Safety. The Modicon M580 are PAC and Safety PLCs with built-in Ethernet for process, high availability & safety solutions. The Modicon M340 offers compactness, flexibility, scalability, and robustness for the process industry and a wide range of demanding automation applications. The Modicon MC80 provides optimized operation, withstanding extreme conditions with high reliability and performance. The Modicon Momentum supports control and distributed I/O system with 4 fundamental components that easily snap together in various combinations to form versatile control systems or sub-systems. EcoStruxure™ Control Expert is the common programming, debugging and operating software for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation Controllers). Failure to apply the mitigations provided below may risk unauthorized access to your PLC, which could result in the possibility of denial of service and loss of confidentiality and integrity of the controller.