Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H

CVEs (1)

Remediations

• Version SV1.70IR26 of BMXNOR0200H includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOR0200H/ethernet-serial-rtu-module-2-x-rj45/
• Schneider Electric is establishing a remediation plan for all future versions of Modicon M340 processors BMXP34* that will include a fix for this vulnerability. We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • Set up network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the devices. • Disable FTP service via EcoStruxureTM Control Expert. This is disabled by default when a new application is created. • Disable Web server service via EcoStruxureTM Control Expert. This is disabled by default when a new application is created. • Configure the Access Control List following the recommendation on the “Modicon Controllers System Cybersecurity”
• Version SV3.60 of BMXNOE0100 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0100/network-module-modicon-m340- modbus-tcp-1-x-rj45-flash-memory-card/
• Version SV6.80 of BMXNOE0110 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0110/ethernet-tcp-ip-network-modulemodicon-m340-automation-platform-flash-memory-card-internal-ram-16-mb-1-x-rj45- 10-100/
• If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Set up network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the devices. • Disable FTP service via EcoStruxureTM Control Expert. This is disabled by default when a new application is created. • Disable Web server service via EcoStruxureTM Control Expert. This is disabled by default when a new application is created. • Configure the Access Control List following the recommendation on the “Modicon Controllers System Cybersecurity”https://download.schneider-electric.com/files?p_Doc_Ref=EIO0000001999&p_enDocType=User+guide&p_File_Name=EIO0000001999-12_Modicon_Controller_Cybersecurity.pdf

Affected Vendors

Affected Products (7)

Affected Sectors

Commercial Facilities, Critical Manufacturing, Energy