Schneider Electric Telvent SAGE RTU DNP3 Improper Input Validation Vulnerability

CVEs (1)

Remediations

• Schneider Electric has created a patch to mitigate this vulnerability on the C3414 LX-800-based RTUs using latest VX-works 6.9.3 OS. Customers may obtain this patch by contacting the Schneider Electric Customer Service Department at 713-920-6832.
• For further information, please find a description and release notes in the Schneider Electric RTU Software Security Bulletin number RTUSW 13001 “Schneider Electric Telvent SAGE RTU DNP3 Improper Input Validation” published December 30, 2013. A Schneider Electric customer login account is required to access this bulletin.
• Because this vulnerability is identified with fuzzing tools, the researchers suggest developers use extensive negative testing during quality control of products. The researchers also suggest blocking DNP3 traffic from traversing onto business or corporate networks through the use of an IPS or firewall with DNP3-specific rule sets.

Affected Vendors

Affected Products (3)