Most recent entries from csaf_se

SEVD-2015-344-01 — GoAhead Web Server vulnerability

Tue, 15 Dec 2015 00:00:00 +0000

Schneider Electric is aware of a proof of concept exploit available for this vulnerability. It is imperative that customers upgrade the firmware for the affected products.

SEVD-2018-081-01 — Embedded FTP Servers for Modicon PAC Controllers

Thu, 22 Mar 2018 03:39:21 +0000

Schneider Electric is aware of multiple vulnerabilities in the FTP servers of its Modicon PAC controllers. Modicon PACs (Programmable Automation Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, and protected way. Our PLCs and PACs supply edge technology, augmenting it with Ethernet connectivity, built-in cybersecurity, and processing power needed to handle Big Data analysis and protect against new vulnerabilities among connected industrial assets, across devices or into the cloud. Failure to address these vulnerabilities could result in unauthorized access to your PLC and a denial of service or other malicious activity. March 2023 Update: Remediation for the Modicon M580 CPU is available for download

SEVD-2018-095-01 — Security Notification - U.motion Builder software

Thu, 05 Apr 2018 00:00:00 +0000

Schneider Electric is aware of an exploit that targets Schneider Electric’s U.motion Builder software. It is imperative customers cease using U.motion Builder software and remove it from their systems immediately.

SEVD-2019-134-11 — Multiple Vulnerabilities in Modicon Controller Products

Tue, 14 May 2019 07:00:00 +0000

Schneider Electric is aware of multiple vulnerabilities in its Modicon Controller products. The [Modicon Programmable Automation controllers](https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/) are used for complex networked communication, display and control applications Failure to apply the mitigations or remediations provided below may risk execution of unsolicited command on the PLC which could result in a loss of availability of the controller.

SESB-2019-214-01 — Wind River VxWorks Vulnerabilities (URGENT/11)

Fri, 02 Aug 2019 00:00:00 +0000

Wind River's VxWorks TCP/IP Stack vulnerabilities have wide-ranging impact across multiple IT and industrial applications. We are working closely with Wind River to understand and assess how these vulnerabilities impact Schneider Electric offers and our customers’ operations. We downloaded Wind River’s patches as soon as they were made available to us, and we have quickly instituted a remediation plan to evolve all current and future products that rely on the Wind River platform to embed these fixes. We will continue to monitor and will respond further if new information becomes available. In the meantime, customers should immediately make sure they have implemented cybersecurity best practices across their operations to protect themselves from these vulnerabilities. Where appropriate this includes locating your industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; and preventing mission-critical systems and devices from being accessed from outside networks. Please subscribe to the Schneider Electric security notification service to be informed of updates to this disclosure, including details on affected products and remediations, as well as other important security notifications: https://www.schneider-electric.com/en/work/support/cybersecurity/security-notifications.jsp For additional information and support, please contact your Schneider Electric sales or service repr…

SEVD-2019-225-01 — Harmony (formerly known as Magelis) HMI Panels

Tue, 13 Aug 2019 09:59:02 +0000

Schneider Electric is aware of a vulnerability in the Harmony (formerly known as Magelis) HMI Panel products. Harmony HMI Panels are the main visible automation component that manage all vital machine features, including visualization, control, supervision, diagnostics, monitoring, and data logging. Failure to apply the mitigations/remediations provided below may risk a temporary Denial of Service. January 2024 Update: A fix is available for HMISCU series.

SEVD-2019-281-02 — Modicon Controllers

Thu, 26 Sep 2019 12:53:28 +0000

Schneider Electric is aware of multiple vulnerabilities in the Modicon Controller products. March 2023 Update: Remediation for the Modicon M580 CPU is available for download

SEVD-2020-014-01 — MSX Configurator

Tue, 14 Jan 2020 00:00:00 +0000

Schneider Electric is aware of a vulnerability in the MSX Configurator product.

SEVD-2020-042-01 — ProSoft Configurator for Modicon PMEPXM0100 (H)

Tue, 11 Feb 2020 00:00:00 +0000

Schneider Electric is aware of a vulnerability in the ProSoft Configurator for the PMEPXM0100 (H) module.

SEVD-2020-070-01 — IGSS (Interactive Graphical SCADA System)

Tue, 10 Mar 2020 00:00:00 +0000

Schneider Electric is aware of multiple vulnerabilities in the IGSS product.