Schneider Electric Modicon M221 PLCs and SoMachine Basic (Update A)

Risk Summary

ATTENTION: Remotely exploitable/low skill level to exploit. Public exploits are available.

CVEs (2)

Remediations

• Schneider Electric recommends that users store project files in secure, access-restricted locations and encrypt project files with reputable third party file encryption tools.
• On June 14, 2017, Schneider Electric released firmware v1.5.1.0 and associated SoMachineBasic V1.5SP1. The new version uses an enhanced encryption mechanism and prevents M221 from returning the password. Users may download SoMachineBasic V1.5SP1 (including firmware v1.5.1.0) from the Schneider Electric web site at the following location:
• Schneider Electric's security notice SEVD-2017-097-01 is available at the following location:
• Schneider Electric's security notice SEVD-2017-097-02 is available at the following location:

Affected Vendors

Affected Products (2)