Schneider Electric Vijeo Designer and EcoStruxureâ„¢ Machine Expert (Update A)

CVEs (1)

Remediations

• If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:Limit authenticated user access to the workstation running Vijeo Designer and implement existing User Account Control practices. • Remove the write permissions for “Everyone” on the folder “C:\Program Files (x86)\Schneider Electric\VijeoDesigner 6.3\Vijeo-Runtime” • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
• Vijeo Designer version 6.3.2.16 delivered with EcoStruxure™ Machine Expert v2.3 includes a fix for this vulnerability. EcoStruxure™ Machine Expert v2.3 is available via the Schneider Electric Software Installer: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER On the engineering workstation, install v2.3 of EcoStruxure™ Machine Expert.
• Version V6.3 SP1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3 SP1 of Vijeo Designer.

Affected Vendors

Affected Products (5)

Affected Sectors

Commercial Facilities, Critical Manufacturing, Energy