Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update A)

CVEs (1)

Remediations

• SV4.30 of Modicon M580 firmware includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware
• SV4.21 of Modicon M580 firmware includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware
• SV4.02.01 of BMENOR2200H firmware includes a fix for this vulnerability and is available here: https://www.se.com/ww/en/product/BMENOR2200H/communication-module-modicon-m580-iec-608705101-104-dnp3-for-severe-environments/
• V1.3.10 of EVLink Pro AC firmware includes a fix for this vulnerability and is available here: https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#software-and-firmware
• • Setup network segmentation and implement a firewall to block all unauthorized access to port 443/TCP • Configure the Access Control List following the recommendations of the user manuals: “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
• If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit.• Setup network segmentation and implement a firewall to block all unauthorized access to port 443/TCP
• • Follow EVlink Pro AC cybersecurity guide https://www.se.com/ww/en/download/document/GEX5261101/

Affected Vendors

Affected Products (8)

Affected Sectors

Commercial Facilities, Critical Manufacturing, Energy