Schneider Electric is aware of a proof of concept exploit available for this vulnerability. It is imperative that customers upgrade the firmware for the affected products.

Schneider Electric is aware of multiple vulnerabilities in the FTP servers of its Modicon PAC controllers. Modicon PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way. Our PLCs and PACs supply edge technology, augmenting it with Ethernet connectivity, built-in cybersecurity, and processing power needed to handle Big Data analysis and protect against new vulnerabilities among connected industrial assets, across devices or into the cloud. Failure to address these vulnerabilities could result in unauthorized access to your PLC and a denial of service or other malicious activity. March 2023 Update: Remediation for the Modicon M580 CPU is available for download

Schneider Electric is aware of an exploit that targets Schneider Electric’s U.motion Builder software. It is imperative customers cease using U.motion Builder software and remove it from their systems immediately.

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controller products. The [Modicon Programmable Automation controllers](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/) are used for complex networked communication, display and control applications Failure to apply the mitigations or remediations provided below may risk execution of unsolicited command on the PLC which could result in a loss of availability of the controller.

Wind River's VxWorks TCP/IP Stack vulnerabilities have wide-ranging impact across multiple IT and industrial applications. We are working closely with Wind River to understand and assess how these vulnerabilities impact Schneider Electric offers and our customers’ operations. We downloaded Wind River’s patches as soon as they were made available to us, and we have quickly instituted a remediation plan to evolve all current and future products that rely on the Wind River platform to embed these fixes. We will continue to monitor and will respond further if new information becomes available. In the meantime, customers should immediately make sure they have implemented cybersecurity best practices across their operations to protect themselves from these vulnerabilities. Where appropriate this includes locating your industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; and preventing mission-critical systems and devices from being accessed from outside networks. Please subscribe to the Schneider Electric security notification service to be informed of updates to this disclosure, including details on affected products and remediations, as well as other important security notifications: https://www.schneider-electric.com/en/work/support/cybersecurity/security-notifications.jsp For additional information and support, please contact your Schneider Electric sales or service repr…

Schneider Electric is aware of a vulnerability in the Harmony (formerly known as Magelis) HMI Panel products. Harmony HMI Panels are the main visible automation component that manage all vital machine features, including visualization, control, supervision, diagnostics, monitoring, and data logging. Failure to apply the mitigations/remediations provided below may risk a temporary Denial of Service. January 2024 Update: A fix is available for HMISCU series.

Schneider Electric is aware of multiple vulnerabilities in the Modicon Controller products. March 2023 Update: Remediation for the Modicon M580 CPU is available for download

Schneider Electric is aware of a vulnerability in the MSX Configurator product.

Schneider Electric is aware of a vulnerability in the ProSoft Configurator for the PMEPXM0100 (H) module.

Schneider Electric is aware of multiple vulnerabilities in the IGSS product.