Number: AV20-301
Date: 12 August 2020
On 11 August 2020 Schneider Electric published Security Notifications highlighting vulnerabilities in the following products:
- Schneider Electric Modbus Serial Driver (64 bits) - versions prior to V3.20 IE 30.
- Schneider Electric Modbus Serial Driver (32 bits) - versions prior to V2.20 IE 30.
- Schneider Electric Modbus Driver Suite - versions prior to V14.15.0.0.
These drivers are used in multiple products including, but not limited to:
- Ecostruxure Control Expert (formerly known as Unity Pro)
- Unity Loader
- EcoStruxure Process Expert (formerly known as Hybrid DCS)
- EcoStruxure OPC UA Server Expert
- OPC Factory Server
- Advantys Configuration Software
- Modbus Communications DTM (Field Devices)
- SoMove
- Ecostruxure Machine Expert (formerly known as SoMachine)
- Ecostruxure Machine Expert Basic
- Harmony® eXLhoist
- EcoStruxure Power Commission
- Schneider Electric spaceLYnk & Wiser for KNX (formerly homeLYnk) - versions prior to V2.5.1
- Schneider Electric Modicon M218 Logic Controller - versions prior to V5.0.0.7
- APC Easy UPS On-Line Software - versions prior to V2.0
- PowerChute Business Edition Software - versions prior to V9.0.x
- Schneider Electric Harmony® eXLhoist Base Stations - versions prior to V 04.00.02.00
- SoMove software - versions prior to V2.8.1
Successful exploitation of these vulnerabilities may allow an actor to achieve local privilege escalation, perform unrestricted brute-force password attacks, cause a denial of service, upload executable files and remote code execution.
The Cyber Centre encourages users and administrators to review the following web links, perform the suggested mitigations and apply the necessary manufacturer updates:
Schneider Electric Modbus Serial Driver
https://www.se.com/ww/en/download/document/SEVD-2020-224-01/
Schneider Electric spaceLYnk & Wiser for KNX (formerly homeLYnk)
https://www.se.com/ww/en/download/document/SEVD-2020-224-02/
Schneider Electric Modicon M218 Logic Controller
https://www.se.com/ww/en/download/document/SEVD-2020-224-03/
APC Easy UPS On-Line Software
https://www.se.com/ww/en/download/document/SEVD-2020-224-04/
PowerChute Business Edition
https://www.se.com/ww/en/download/document/SEVD-2020-224-05/
Schneider Electric Harmony® eXLhoist Base Stations
https://www.se.com/ww/en/download/document/SEVD-2020-224-06/
Schneider Electric SoMove Software
https://www.se.com/ww/en/download/document/SEVD-2020-224-07/
Note to Readers
The Canadian Centre for Cyber Security (Cyber Centre) operates as part of the Communications Security Establishment. We are Canada’s national authority on cyber security and we lead the government’s response to cyber security events. As Canada's national computer security incident response team, the Cyber Centre works in close collaboration with government departments, critical infrastructure, Canadian businesses and international partners to prepare for, respond to, mitigate, and recover from cyber events. We do this by providing authoritative advice and support, and coordinating information sharing and incident response. The Cyber Centre is outward-facing, welcoming partnerships that help build a stronger, more resilient cyber space in Canada.