Schneider Electric Security Notification
Modicon PAC Controllers
9 August 2022 (13 August 2024)

Overview
Schneider Electric is aware of a vulnerability in its Modicon PAC Controllers.
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation
Controllers) control and monitor industrial operations in a sustainable, flexible, efficient andprotected way.
Failure to apply the remediations provided below may risk read access to memory content of thecontrollers, which could result in exposure of sensitive information such as application password
hash and project data to the attacker.
August 2024 Update: A remediation is available for the Modicon M580 CPU Safety (page 2).

Affected Products and Versions
ProductVersion

Modicon M340 CPU (part numbers BMXP34*)

Versions prior to v3.40

Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding
M580 CPU Safety)
Modicon M580 CPU Safety (part numbers BMEP58*S andBMEH58*S)

Versions prior to v4.20
Versions prior to SV4.21

Modicon MC80 (BMKC80)

Versions prior to v1.70

Modicon Momentum CPU (171CBU*)

Versions prior to v2.4

Legacy Modicon QuantumAll versions

Vulnerability Details
CVE ID: CVE-2021-22786
CVSS v3.1 Base Score 7.5 | High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200: Information Exposure vulnerability exists that could cause the exposure of sensitive
information stored on the memory of the controller when communicating over the Modbus TCP
protocol.

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 1 of 8

Schneider Electric Security Notification
Remediation
Affected Products
Modicon Modicon
M340 CPU (partnumbers BMXP34*)
Versions prior to v3.40
Modicon M580 CPU(part numbers
BMEP* and BMEH*,
excluding M580 CPUSafety)
Versions prior to v4.10
Modicon M580 CPUSafety(part numbers
BMEP58*S andBMEH58*S)
Versions prior toSV4.21

Remediations
Firmware v3.40 of Modicon includes a fix for this vulnerability and isavailable for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_xx.xx/
Firmware v4.10 includes a fix for this vulnerability and is available fordownload here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.
10/
Firmware SV4.21 includes a fix this vulnerability and is available fordownload here:
https://www.se.com/ww/en/product-range/62098-modicon-m580pac-controller/#software-and-firmware
Important: customer needs to use version of EcoStruxure™ Control
Expert V16.0 HF001 minimum to connect with the latest version ofM580 CPU Safety. The software is available for download here:
https://www.se.com/ww/en/product-range/548-ecostruxure-controlexpert-unity-pro/#software-and-firmware

Modicon MC80
(BMKC80)
Versions prior to v1.70

Firmware V1.70 includes a fix for this vulnerability and is available
for download here:
https://www.se.com/ww/en/download/document/BMKC80_Firmware_upgrade/Modicon
MOMENTUM CPU(171CBU*)
Versions prior to v2.4

Firmware V2.4 includes a fix for this vulnerability and is available fordownload here:
https://www.se.com/ww/en/download/document/Momentum_FW_up
date/

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 2 of 8

Schneider Electric Security Notification

Legacy Modicon
QuantumAll versions

Schneider Electric’s Modicon Quantum controllers have reachedtheir end of life and are no longer commercially available. They havebeen replaced by the Modicon M580 ePAC Controller, our current
product offer.
Customers should strongly consider migrating to the Modicon M580ePAC.
Please contact your local Schneider Electric technical support formore information.

Customers should use appropriate patching methodologies when applying these patches totheir systems. We strongly recommend the use of back-ups and evaluating the impact of thesepatches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately
apply the mitigations provided in the table below.
Affected ProductMitigations••

Modicon M340
CPU (partnumbersBMXP34*)
Versions prior tov3.40•

Modicon MC80(BMKC80)
Versions prior tov1.70•

Setup an application password in the project properties.
Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP.
Configure the Access Control List following the recommendationsof the user manuals:o “Modicon M340 for Ethernet Communications Modules
and Processors User Manual” in chapter “Messaging
Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K0
1000/
o “Modicon MC80 Programmable Logic Controller (PLC)
manual” in the chapter “Access Control List (ACL)”
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Nam
e=EIO0000002071.02.pdf&p_Doc_Ref=EIO0000002071
o “Momentum for EcoStruxure™ Control Expert – 171 CBU
78090, 171 CBU 98090, 171 CBU 98091 Processors”
manual in the chapter “Modbus Messaging and AccessControl” https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Nam
e=HRB44124.08.pdf&p_Doc_Ref=HRB44124
Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security Reference
Manual,” in chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 3 of 8

Schneider Electric Security Notification•Modicon
MOMENTUM
CPU (171CBU*)
Versions prior tov2.4•To ensure you are informed of all updates, including details on affected
products and remediation plans, subscribe to Schneider Electric’s
security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp•••

Modicon M580
CPUVersions prior tov4.20

Use a BMENOC module and follow the instructions to configure
IPSEC feature as described in the guideline “Modicon M580 –BMENOC03.1 Ethernet Communications Schneider Electric
Security Notification Module, Installation and Configuration Guide”
in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
Setup a VPN between the Modicon PLC controller and theengineering workstation containing EcoStruxure Control Expert orProcess Expert. Note: this functionality may be provided by an
external IPSEC compatible firewall located close to the controller.

•••Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP.
Configure the Access Control List following the recommendationsof the user manual “Modicon M580, Hardware, Reference
Manual”:
https://www.se.com/ww/en/download/document/EIO0000001578/
Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security Reference
Manual,” in chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/
Use a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter “Configuring
the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
Use a BMENOC module and follow the instructions to configure
IPSEC feature as described in the guideline “Modicon M580 –BMENOC03.1 Ethernet Communications Schneider ElectricSecurity Notification Module, Installation and Configuration Guide”
in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
Setup a VPN between the Modicon PLC impacted modules andthe engineering workstation containing EcoStruxure™ Control
Expert or Process Expert.
Ensure the M580 CPU is running with the memory protection
activated by configuring the input bit to a physical input, for moredetails refer to the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual”, “CPU Memory
Protection section”: https://www.schneiderelectric.com/en/download/document/EIO0000001999/

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 4 of 8Schneider Electric Security Notificationo•••••
Modicon M580
Safety CPU(part numbers
BMEP58*S andBMEH58*S)
Versions prior tov4.21••NOTE: The CPU memory protection cannot be configured
with Hot Standby CPUs. In such cases, use IPsec
encrypted communication

Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP.
Configure the Access Control List following the recommendationsof the user manual “Modicon M580, Hardware, Reference
Manual”:
https://www.se.com/ww/en/download/document/EIO0000001578/
Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security Reference
Manual,” in chapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/
Use a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter “Configuring
the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
Use a BMENOC module and follow the instructions to configure
IPSEC feature as described in the guideline “Modicon M580 –BMENOC03.1 Ethernet Communications Schneider ElectricSecurity Notification Module, Installation and Configuration Guide”
in the chapter “Configuring IPSEC communications”:
https://www.se.com/ww/en/download/document/HRB62665/
Setup a VPN between the Modicon PLC impacted modules andthe engineering workstation containing EcoStruxure™ Control
Expert or Process Expert.
Ensure the CPU is running with the memory protection activatedby configuring the input bit to a physical input , for more details
refer to the following guideline “Modicon Controllers Platform
Cyber Security Reference Manual”, “CPU Memory Protection
section”: https://www.schneiderelectric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured
with Hot Standby CPUs. In such cases, use IPsec
encrypted communication

To further reduce the attack surface on Modicon M580 CPU Safety:• Ensure the CPU is running in Safety mode and maintenance input
is configured to maintain this Safety mode during operation – referto the document Modicon M580 - Safety System Planning Guide in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 5 of 8

Schneider Electric Security Notification••
Legacy Modicon
QuantumAll versions

Setup network segmentation and implement a firewall to block all
unauthorized access to port 502/TCP.
Configure the Access Control List feature as mentioned in“Quantum using EcoStruxure™ Control Expert – TCP/IP
Configuration, User Manual” in chapter “Software Settings for
Ethernet Communication / Messaging / Quantum NOE Ethernet
Messaging Configuration”:
https://www.se.com/ww/en/download/document/33002467K01000/

General Security Recommendations
We strongly recommend the following industry cybersecurity best practices.
••••••••

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Install physical controls so no unauthorized personnel can access your industrial control
and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the network intended forthat device.
Scan all methods of mobile data exchange with the isolated network such as CDs, USBdrives, etc. before use in the terminals or any node connected to these networks.
Never allow mobile devices that have connected to any other network besides theintended network to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems and ensure thatthey are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs). Recognize that VPNs may have vulnerabilities and should be updated to themost current version available. Also, understand that VPNs are only as secure as theconnected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best
Practices document.

Acknowledgements
Schneider Electric recognizes the following researcher for identifying and helping to coordinate
a response to this vulnerability:
CVE

Researcher

CVE-2021-22786

Jie Chen, NSFocus

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 6 of 8

Schneider Electric Security Notification
For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, contact
your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity
Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will befully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit thecompany’s cybersecurity support portal page:https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
LEGAL DISCLAIMER
THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALSLINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE ANOVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS,REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN“AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRICDISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED,INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THEIDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANYDAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDINGDIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIALDAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELYLIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAYRESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHTTO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

About Schneider ElectricSchneider’s purpose is to empower all to make the most of our energy and resources, bridging progress andsustainability for all. We call this Life Is On.
Our mission is to be your digital partner for Sustainability and Efficiency.
We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloudconnecting products, controls, software and services, across the entire lifecycle, enabling integrated companymanagement, for homes, buildings, data centers, infrastructure and industries.
We are the most local of global companies. We are advocates of open standards and partnership ecosystems thatare passionate about our shared Meaningful Purpose, Inclusive and Empowered values.
www.se.com

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 7 of 8

Schneider Electric Security Notification
Revision Control:
Version 1.0.0
09 August 2022
Version 1.1.0
06 September 2022

Version 2.0.0
11 October 2022

Version 3.0.0
13 December 2022

Version 4.0.0
14 March 2023
Version 5.0.0
13 August 2024

CPCERT

Original Release
The version number for Modicon M580 thataddresses these vulnerabilities has been updated
from v4.01 to v4.02.
A clarification was added to the list of affected
products by splitting Modicon M580 and Modicon
M580 Safety CPU ranges. The purpose of thenotification update is to inform customers that thelatest fix Modicon M580 v4.02 does not apply to
the Safety range of M580. It is highly
recommended that customers using Modicon
M580 Safety ranges continue to implement themitigations shared in this document.
The Modicon M580 sv4.02 firmware has been
retracted for quality issues and is no longer
available for download. Additional mitigations havebeen introduced for Modicon M580 CPU andM580 CPU Safety, and we urge customers to
deploy these mitigations to further reduce the riskof potential exploitation of identified vulnerabilities.
Remediation for the Modicon M580 CPU isavailable for download.
A remediation is available for the Modicon M580
CPU Safety (page 2).

Digitally signed by CPCERT
Date: 2024.08.12 12:29:17 -04'00'

9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022-221-04 v5.0.0 Page 8 of 8