ICS Advisories

Risk evaluation

Schneider Electric is aware of its vulnerability in its EcoStruxure Panel Server offer. The EcoStruxure Panel Server is a high performance, modular gateway with enhanced cybersecurity that provides easy and fast connections to multiple concurrent edge control or cloud applications. Failure to apply the remediations provided below may risk unauthorized authentication, which could lead to access to sensitive information.

Mitigatiesamenvatting

Version 002.006.000 of EcoStruxure Panel Server includes a fix for this vulnerability and is available for download here: • https://www.se.com/ww/en/download/document/PAS800_Fir mware_Package/ • Reboot needed: Yes

Risk evaluation

Schneider Electric is aware of a vulnerability in its EasyLogic T150 (formerly known as Saitel DR) and Saitel DP Remote Terminal Unit & Controller products. The [EasyLogic T150 (formerly known as Saitel DR RTU)](https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=62685#overview) is a field device, offering a solid and powerful modular platform for data acquisition, communication, automation and IED integration for distribution and transmission networks, generation sector and railway. The [Saitel DP RTU](https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61747) is a modular platform for medium voltage and high voltage public distribution and transmission substation control. Failure to apply the fix provided below may risk a path traversal–based attack in which an authenticated user could gain unauthorized file access.

Mitigatiesamenvatting

Version 11.06.32 of EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller includes a fix for this vulnerability and is available for download here: • Contact Schneider Electric’s Customer Care Center to download this firmware. • Reboot needed: Yes

Risk evaluation

Schneider Electric is aware of a vulnerability in its Easergy MiCOM Px40 Series products. The [Easergy MiCOM Px40](https://www.se.com/ww/en/product-subcategory/4725-easergy-micom-px40-series/?filter=business-6-medium-voltage-distribution-and-grid-automation) is a protection relay series for Medium Voltage, High Voltage and Extra High Voltage protection. Failure to apply the mitigations provided below may risk unauthorized exposure of basic device identification through the SNMP protocol.

Mitigatiesamenvatting

For customers who do not require SNMP Contact Schneider Electric's [Customer Care Center](https://www.se.com/ww/en/work/support/contacts.jsp) to upgrade the Firmware to a version without SNMP functionality. If customers choose not to apply the upgrade provided above, they should immediately apply the following mitigations to reduce the risk of exploit: * Use relays only in a protected network environment, * Use firewalls to protect and separate the control system network from other networks, * Use VPN (Virtual Private Networks) tunnels if remote access is required. For customers who require SNMP Please immediately apply the following mitigations to reduce the risk of exploit: * Use relays only in a protected network environment, * Use firewalls to protect and separate the control system network from other networks, * Use VPN (Virtual Private Networks) tunnels if remote access is required.

Risk evaluation

Schneider Electric is aware of a vulnerability in its EcostruxureTM Machine Expert HVAC product. The [EcostruxureTM Machine Expert HVAC](https://www.se.com/ww/en/download/document/EcoStruxureME_HVAC/) product is a programming software for Modicon M171-M172 logic controllers. Failure to apply the remediation provided below may risk in revealing sensitive information, which could result in disclosing protected source code, leading to loss of confidentiality.

Mitigatiesamenvatting

Version 1.10.0 of Ecostruxure™ Machine Expert HVAC includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/EcoStruxureME_HVAC_1_10_0/

Risk evaluation

CODESYS Modbus is an add‑on for the CODESYS Development System that provides a fully integrated Modbus protocol stack along with diagnostic capabilities. A flaw in the CODESYS Modbus TCP Server protocol stack library results in a vulnerability. When a Modbus TCP server is configured, this vulnerable protocol stack is downloaded to and executed by CODESYS Control runtime systems. The vulnerability is caused by a resource management issue in the Modbus TCP server and is only exploitable if a race condition in the connection handling is successfully triggered. Over time, this may exhaust the configured maximum number of connections, potentially preventing new connections from being accepted. Existing connections remain unaffected and continue to operate normally. This issue affects only CODESYS projects that include a Modbus TCP server configuration.

Mitigatiesamenvatting

Update the following product to version 4.6.0.0. * CODESYS Modbus To make the fix effective for existing CODESYS projects, you must additionally update the local Modbus TCP Server in the device tree to the latest version and perform a download of the CODESYS application to the PLC. The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area https://www.codesys.com/download/.

Risk evaluation

The Firmware installed on the CR3171 is impacted by various CODESYS vulnerabilities.

Mitigatiesamenvatting

will be fixed in Firmware Version 3.3

Risk evaluation

The PASvisu Runtime is affected by a vulnerability in a third-party component which can be exploited by malicious web requests.

Mitigatiesamenvatting

Limit network access to PASvisu server by using a firewall, a host-based firewall or similar measures.

Risk evaluation

Attacks are possible when installing key files and digitally signed objects. These attacks can only be carried out if these files are uploaded and installed by a logged-in user with high privileges.

Mitigatiesamenvatting

Phoenix Contact strongly recommends to upload firmware only from trusted source and to thorougly check the SHA256 checksum of the firmware image to be uploaded.

Risk evaluation

The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.

Mitigatiesamenvatting

The display unit's firmware versions below 4.3.4 are affected. To address the vulnerability, customers are strongly recommended to update the display unit of their devices to firmware version 4.3.4. Endress+Hauser will include this firmware version in the MCS200HW products starting with version 1.11.5.6R. Alternatively, customers can contact Endress+Hauser directly to obtain the updated display firmware, or download the original firmware - including update instructions - from the Phoenix Contact website referenced below.

Risk evaluation

Vulnerabilities in WALL IE devices with firmware <= V1.10.210 that allow an attacker to gain control over the device.

Mitigatiesamenvatting

Update to latest firmware 1.10.232

Risk evaluation

The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.

Mitigatiesamenvatting

The display unit's firmware versions below 4.3.4 are affected. To address the vulnerability, customers are strongly recommended to update the display unit of their devices to firmware version 4.3.4. Endress+Hauser will include this firmware version in the MCS200HW products starting with version 1.11.5.6R. Alternatively, customers can contact Endress+Hauser directly to obtain the updated display firmware, or download the original firmware - including update instructions - from the Phoenix Contact website referenced below.

Risk evaluation

FreeRTOS has several known vulnerabilities and is used in various SICK products. A current analysis confirms that the identified vulnerabilities in FreeRTOS do not affect the mentioned SICK products. At this time, there is no indication of any potential risks to these SICK products.

Mitigatiesamenvatting

Zie de officiële CISA-advisory voor mitigerende maatregelen.

Risk evaluation

Schneider Electric is aware of a vulnerability in its Modicon M340 and BMXNOE0100 and BMXNOE0110 products. The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network modules used with Modicon M340. Failure to apply the mitigations provided below may prevent user to update the device firmware and prevent proper behavior of the webserver. The BMXNOE and Modicon M340 operations are not impacted by this vulnerability. August Update: Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon M340 module) and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)

Mitigatiesamenvatting

Version SV3.60 of BMXNOE0100 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0100/network-module-modicon-m340-modbus-tcp-1-x-rj45-flash-memory-card

Risk evaluation

Schneider Electric is aware of a vulnerability in its Web Server on Modicon M340 and BMXNOE0100/0110, BMXNOR0200H communication modules products. The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network communication modules used with Modicon M340. BMXNOR0200H is a communication module that enables M580 and M340 platforms to use RTU protocol exchange with RTU stations. Failure to apply the remediation/mitigations provided below may risk information disclosure on web pages, modification of web pages and denial of serviceClick or tap here to enter text., which could result in the unavailability of the controllers or modules. August Update: Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon M340 module) and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)

Mitigatiesamenvatting

Version SV1.70IR26 of BMXNOR0200H includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOR0200H/ethernet-serial-rtu-module-2-x-rj45/

Risk evaluation

Schneider Electric is aware of a RADIUS protocol vulnerability affecting its Modicon Network Managed Switch product. The Modicon Network Managed Switch product provides connectivity for multiple Ethernet devices, network management, enhanced cyber security and more advanced switching features. Failure to apply the mitigation provided below may risk forgery attacks in RADIUS Protocol, which could result in modification of any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response which could result in the possibility of denial of service and loss of confidentiality, integrity of the devices connected to the switch.

Mitigatiesamenvatting

The default RADIUS configuration is not vulnerable. However, if the RADIUS Server Message Authenticator option is disabled, the product becomes vulnerable.We advise keeping this parameter in its default (enabled) state.This parameter can be configured via CLI and SNMP:TCSESM* CLI: radius server msgauthMIB: hmAgentRadiusServerMsgAuth

Risk evaluation

Schneider Electric is aware of vulnerabilities in its PowerChute™ Serial Shutdown product. The [PowerChute Serial Shutdown](https://www.se.com/ww/en/product-range/137943580-powerchute-serial-shutdown/#products) product is a UPS management software enabling graceful system shutdown and energy management capabilities for desktop, servers and workstations. Failure to apply the remediation provided below may risk improper input validation which could result in disruption of operations and access to system data.

Mitigatiesamenvatting

Version v1.5 of PowerChute™ Serial Shutdown includes a fix for this vulnerability and is available for download here: • Windows: https://www.se.com/ww/en/download/document/SPD-PCSS_WIN_EN/ Specific instructions and hardening guidelines for these mitigations can be found in the [Security Handbook](https://download.schneider-electric.com/files?p_Doc_Ref=SPD_CCON-PCSSSH_EN).

Risk evaluation

A security vulnerability has been identified in the Web-Based Management (WBM) function when OpenVPN is enabled.

Mitigatiesamenvatting

The user is able to drop privileges of OpenVPN. How to do this is described in the manual "WAGO I/O System 750/753" at section 7.1.1.5.1.

Risk evaluation

Vulnerabilities in PROFINET-Switch devices with firmware <= V1.12.010 that allow an attacker to gain control over the device.

Mitigatiesamenvatting

Update to latest firmware 1.12.100

Risk evaluation

Multiple vulnerabilities have been discovered in MB connect line mbCONNECT24/mymbCONNECT24 that could allow RCE, SQLi or information leakage.

Mitigatiesamenvatting

Update the mbCONNECT24/mymbCONNECT24 instance to version 2.19.4.

Risk evaluation

Multiple vulnerabilities in a Qualcomm component have been reported in a closed-source report. This component is an integral part of the radio chip found in several Endress+Hauser products.

Mitigatiesamenvatting

If a firmware update is no longer possible, it is recommended to replace the device.

Risk evaluation

Multiple Endress+Hauser devices are prone to vulnerabilities found in e!Runtime and the CODESYS V3 framework.

Mitigatiesamenvatting

The CDC 90 device is not designed for network connectivity by default. Since it is not connected to a network, the vulnerabilities cannot be exploited. However, if the customer chooses to connect the device to a network, the default firewall settings should be maintained, as this will mitigate the security vulnerabilities. For the CC 100 and PFC 200 devices, ensure that the default firewall settings remain intact and that both PLC Runtime and PLC WebVisu are disabled. This configuration effectively mitigates the identified security vulnerabilities.

Risk evaluation

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, M258, and LMC058 products. The [Modicon Controllers M241 / M251 / M258](https://www.se.com/ww/en/product-category/3900-plc-pac-and-dedicated-controllers/) and [Modicon LMC058](https://www.se.com/ww/en/product-range/7744-modicon-lmc058/) are Programmable Logic Controllers for performance-demanding applications. Failure to apply the remediation or mitigations provided below may risk a Cross-site Scripting or an open redirect attack which could result in an account takeover scenario or the execution of code in the user browser.

Mitigatiesamenvatting

Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure™ Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/ On the engineering workstation install v2.5.0.1 of EcoStruxure™ Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/ Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/EIO0000003059/

Risk evaluation

Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, and M262 products. The Modicon Controllers M241 / M251 / M262 are Programmable Logic Controllers for performancedemanding applications. Failure to apply the remediation provided below may risk Denial of Service attack which could result in loss of availability of the controller

Mitigatiesamenvatting

Modicon Controller M241 Firmware version 5.4.13.12 delivered with EcoStruxure™ Machine Expert v2.5.0.1 includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/ On the engineering workstation install v2.5.0.1 of EcoStruxure™ Machine Expert. For help refer to Schneider Electric Software Installer User Guide available here: https://www.se.com/ww/en/download/document/EIO0000005500/ Update Modicon Controller M241 to the latest Firmware and perform reboot. For instructions refer to Modicon M241 Logic Controller, Programming Guide: https://www.se.com/ww/en/download/document/EIO0000003059/

Risk evaluation

Multiple vulnerabilities have been identified in WAGO Solution Builder and WAGO Device Sphere that affect components responsible for authentication and system communication.

Mitigatiesamenvatting

Update to WAGO Device Sphere version 1.2.2. and WAGO Solution Builder version 2.4.2

Risk evaluation

The VC Hub incorporates the Magick.NET‑Q16‑AnyCPU component, derived from ImageMagick, to process user‑uploaded images and generate thumbnails within the projects image library. Only authenticated users with the Design Project Permission can upload images.

Mitigatiesamenvatting

Update the WAGO Visualization And Control Hub to version 5.0.1.