Schneider Electric Quantum Ethernet Module Hard-Coded Credentials

CVEs (1)

Remediations

• Schneider Electric has created firmware upgrades that resolve the Telnet and Windriver debug port vulnerabilities for all affected products by removing the Telnet and Windriver services from these modules. According to Schneider Electric, removing these services will not affect the capacities/functionalities of the product or impact the performance of customer installations. Telnet and Windriver debug services were installed only for advanced troubleshooting use and were never intended for customer use.
• Schneider Electric has posted firmware upgrades on their Web site, (http://www.schneider-electric.com/download/ww/en/results/3541958-SoftwareFirmware/). Users should ensure they are using the minimum versions referenced below: Quantum - 140NOE77101 Exec V5.01 or greater for Unity Users, 140NOE77111 Exec V5.11 or greater, 140NOE77101 Exec. V4.9 or greater for Concept Users, 140NOE77111 Exec. V5.5 or greater for Concept Users, 140CPU65150 Exec V3.8 or greater, 140CPU65160 Exec V3.8 or greater, 140CPU65260 Exec V3.8 or greater, and 140NOC77101 Exec V1.03 or greater.
• Premium - TSXETY4103 Exec V5.2 or greater, TSXETY5103 Exec V5.5 or greater, TSXP571634 Exec V5.2 or greater, TSXP572634 Exec V5.2 or greater, TSXP573634 Exec V5.2 or greater, TSXP574634 Exec V3.8 or greater, TSXP575634 Exec V3.8 or greater, TSXP576634 Exec V3.8 or greater, and TSXETC101 Exec V2.01 or greater.
• M340 - BMXNOE0100 Exec V2.50 or greater, BMXNOE0110 Exec v5.3 or greater, and BMXNOC0401 Exec V2.01 or greater.
• Schneider has also released a firmware upgrade to address the FTP service vulnerability referenced above. It is available on selected Quantum programmable logic controller modules. This upgrade includes a new feature that allows the user to enable or disable both the FTP and HTTP services on the modules. Disabling these services will mitigate the vulnerability mentioned above. The following products support the HTTP and FTP service enable and disable feature: 140NOE77101 Firmware Version 06.00 or greater, and 140NOE77111 Firmware Version: 06.00 or greater.

Affected Vendors

Affected Products (26)