Schneider Electric Security Notification
EcoStruxure™ Control Expert, EcoStruxure™ Process Expert andModicon M340, M580 and M580 CPU Safety
10 January 2023 (13 August 2024)

Overview
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert,
EcoStruxure™ Process Expert, Modicon M340, M580 and M580 CPU Safety.
The Modicon M580 are PAC and Safety PLCs with built-in Ethernet for process, high availability& safety solutions.
The Modicon M340 offers compactness, flexibility, scalability, and robustness for the processindustry and a wide range of demanding automation applications.
EcoStruxure™ Control Expert is the common programming, debugging and operating software
for Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable AutomationControllers).
The EcoStruxure™ Process Expert DCS is a single automation system to engineer, operate,
and maintain your entire infrastructure for a sustainable, productive and market-agile plant.
Failure to apply the mitigations provided below may risk unauthorized access to your PLC,
which could result in the possibility of denial of service and loss of confidentiality, integrity of thecontroller.
August 2024 Update: A remediation is available on Modicon M580 CPU Safety (page 2).

Affected Products and Versions
ProductVersion

EcoStruxure™ Control Expert

All versions

EcoStruxure™ Process Expert

All versions

Modicon M340 CPU (part numbers BMXP34*)

All versions

Modicon M580 CPU (part numbers BMEP* and BMEH*)

Versions prior toSV4.20Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)

Versions prior toSV4.21

Modicon Momentum Unity M1E Processor (171CBU*)

All versions

Modicon MC80 (BMKC80)

All versions

10-Jan-23 (13-Aug-24)

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 1 of 10

Schneider Electric Security Notification
Vulnerability Details
CVE ID: CVE-2022-45789
CVSS v3.1 Base Score 8.1 | High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could
cause execution of unauthorized Modbus functions on the controller when hijacking anauthenticated Modbus session.

Remediation
Affected Product & Version

Remediation

Modicon M580 (part numbers
BMEP* and BMEH*, excluding
M580 CPU Safety)
Versions prior to SV4.20

Firmware SV4.20 includes a fix for this vulnerability andis available for download here:
https://www.se.com/ww/en/product-range/62098modicon-m580-epac/#software-and-firmware
Firmware SV4.21 includes a fix for this vulnerability andis available for download here:

Modicon M580 CPU Safety (partnumbers BMEP58*S andBMEH58*S)
Versions prior to SV4.21

https://www.se.com/ww/en/product-range/62098modicon-m580-pac-controller/#software-andfirmware
Important: customer needs to use version of
EcoStruxure Control Expert v16.0 HF001 minimum toconnect with the latest version of M580 CPU Safety.
The software is available for download here:
https://www.se.com/ww/en/product-range/548ecostruxure-control-expert-unity-pro/#software-andfirmware

Customers should use appropriate patching methodologies when applying these patches totheir systems. We strongly recommend the use of back-ups and evaluating the impact of thesepatches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Support Center if you need assistance removing a patch.

10-Jan-23 (13-Aug-24)

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 2 of 10

Schneider Electric Security Notification
Mitigations
Affected Product &VersionMitigations

Schneider Electric is establishing a remediation plan for all futureversions of EcoStruxure™ Control Expert that will include a fix for thisvulnerability. We will update this document when the remediation isavailable. Until then, customers should immediately apply thefollowing mitigations to reduce the risk of exploit:
EcoStruxure™ Control• Setup a VPN between the Modicon PLC controllers and theExpert
engineering workstation containing EcoStruxureTM ControlAll versions
Expert. Note: this functionality may be provided by an external
IPSEC compatible firewall located close to the controller.
• Harden the workstation running EcoStruxure™ ControlExpert.

EcoStruxure™
Process Expert
All versions

Schneider Electric is establishing a remediation plan for all futureversions of EcoStruxure™ Process Expert that will include a fix for
this vulnerability. We will update this document when the remediation
is available. Until then, customers should immediately apply thefollowing mitigations to reduce the risk of exploit:• Setup a VPN between the Modicon PLC controllers and theengineering workstation containing EcoStruxureTM Process
Expert. Note: this functionality may be provided by an external
IPSEC compatible firewall located close to the controller.
• Harden the workstation running EcoStruxure™ ProcessExpert.

Modicon M340 CPU(part numbers
BMXP34*)All versions

Schneider Electric is establishing a remediation plan for all futureversions of M340 Controllers that will include a fix for thisvulnerability. We will update this document when the remediation isavailable. Until then, customers should immediately apply thefollowing mitigations to reduce the risk of exploit:• Setup an application password in the project properties.
• Setup network segmentation and implement a firewall to block
all unauthorized access to port 502/TCP.
• Configure the Access Control List following therecommendations of the user manuals:o “Modicon M340 for Ethernet Communications Modules
and Processors User Manual” in chapter “MessagingConfiguration Parameters”:
https://www.se.com/ww/en/download/document/31007
131K01000/• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security

10-Jan-23 (13-Aug-24)

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 3 of 10

Schneider Electric Security Notification•Reference Manual,” in chapter “Setup securedcommunications”:
https://www.se.com/ww/en/download/document/EIO00000019
99/
Consider the use of external firewall devices such as
EAGLE40-07 from Belden to establish VPN connections for
M340 & M580 architectures. For more details refer to thechapter “How to protect M580 and M340 architectures with
EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO00000019
99/

If customers choose not to apply the remediation, it isrecommended to apply the following mitigations to reduce therisk of the exploit:• Setup an application password in the project properties.
• Setup network segmentation and implement a firewall to block
all unauthorized access to port 502/TCP.
• Configure the Access Control List following therecommendations of the user manuals:o “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO00
00001578/• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup securedcommunications”:
Modicon M580 CPU
https://www.se.com/ww/en/download/document/EIO00000019(part numbers BMEP*and BMEH*)
99/
Versions prior to SV4.20
o use a BMENOC module and follow the instructions toconfigure IPSEC feature as described in the guideline“Modicon M580 - BMENOC03.1 Ethernet
Communications Schneider Electric Security
Notification Module, Installation and Configuration
Guide” in the chapter “Configuring IPSEC
communications”:
https://www.se.com/ww/en/download/document/HRB62665/•

10-Jan-23 (13-Aug-24)

ORUse a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter“Configuring the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 4 of 10

Schneider Electric Security Notification••

ORConsider use of external firewall devices such as EAGLE4007 from Belden to establish VPN connections for M340 &M580 architectures. For more details refer to the chapter“How to protect M580 and M340 architectures with EAGLE40
using VPN”:
https://www.se.com/ww/en/download/document/EIO00000019
99/Ensure the M580 CPU is running with the memory protection
activated by configuring the input bit to a physical input, formore details refer to the following guideline “ModiconControllers Platform Cyber Security Reference Manual”, “CPUMemory Protection section”: https://www.schneiderelectric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be
configured with M580 Hot Standby CPUs. In suchcases, use IPsec encrypted communication.

If customers choose not to apply the remediation, it isrecommended to apply the following mitigations to reduce therisk of the exploit:• Setup an application password in the project properties.
• Setup network segmentation and implement a firewall to block
all unauthorized access to port 502/TCP.
• Configure the Access Control List following therecommendations of the user manuals:o “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO00
00001578/
Modicon M580 CPU• Setup a secure communication according to the following
Safety (BMEP58*S andguideline “Modicon Controllers Platform Cyber Security
BMEH58*S)
Versions prior to SV4.21
Reference Manual,” in chapter “Setup securedcommunications”:
https://www.se.com/ww/en/download/document/EIO00000019
99/
o use a BMENOC module and follow the instructions toconfigure IPSEC feature as described in the guideline“Modicon M580 - BMENOC03.1 Ethernet
Communications Schneider Electric Security
Notification Module, Installation and Configuration
Guide” in the chapter “Configuring IPSEC
communications”:

10-Jan-23 (13-Aug-24)

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 5 of 10

Schneider Electric Security Notification
https://www.se.com/ww/en/download/document/HRB62665/•••ORUse a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter“Configuring the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
ORConsider use of external firewall devices such as EAGLE4007 from Belden to establish VPN connections for M340 &M580 architectures. For more details refer to the chapter“How to protect M580 and M340 architectures with EAGLE40
using VPN”:
https://www.se.com/ww/en/download/document/EIO00000019
99/Ensure the M580 CPU is running with the memory protection
activated by configuring the input bit to a physical input, formore details refer to the following guideline “ModiconControllers Platform Cyber Security Reference Manual”, “CPUMemory Protection section”: https://www.schneiderelectric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be
configured with M580 Hot Standby CPUs. In suchcases, use IPsec encrypted communication.

To further reduce the attack surface on Modicon M580 CPU Safety:o Ensure the CPU is running in Safety mode andmaintenance input is configured to maintain this Safetymode during operation – refer to the document
Modicon M580 - Safety System Planning Guide - inthe chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

10-Jan-23 (13-Aug-24)

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 6 of 10

Schneider Electric Security Notification
Schneider Electric is establishing a remediation plan for all futureversions of Modicon MOMENTUM Unity M1E controllers that will
include a fix for this vulnerability. We will update this document when
the remediation is available. Until then, customers should
immediately apply the following mitigations to reduce the risk ofexploit:• Setup an application password in the projectproperties• Setup network segmentation and implement a firewall
Modicon MOMENTUM
to block all unauthorized access to port 502/TCP
Unity M1E Processor• Configure the Access Control List following the(part numbers
recommendations of the user manuals:171CBU*)• “Momentum for EcoStruxure™ Control Expert
All versions– 171 CBU 78090, 171 CBU 98090, 171 CBU
98091 Processors” manual in the chapter “Modbus
Messaging and Access Control”:
https://www.se.com/ww/en/download/document/HRB44124/• Setup a secure communication according to
the following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” inchapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EI
O0000001999/

Modicon MC80 (partnumbers BMKC80)
All versions

10-Jan-23 (13-Aug-24)

Schneider Electric is establishing a remediation plan for all futureversions of Modicon MC80 controllers that will include a fix for thisvulnerability. We will update this document when the remediation isavailable. Until then, customers should immediately apply thefollowing mitigations to reduce the risk of exploit:• Setup an application password in the projectproperties• Setup network segmentation and implement a firewall
to block all unauthorized access to port 502/TCP• Configure the Access Control List following therecommendations of the user manuals:• “Modicon MC80 Programmable Logic
Controller (PLC) manual” in the chapter “AccessControl List (ACL)”:https://www.se.com/ww/en/download/document/EIO0000002071/• Setup a secure communication according tothe following guideline “Modicon Controllers
Platform Cyber Security Reference Manual,” inchapter “Setup secured communications”:
https://www.se.com/ww/en/download/document/EIO0000001999/Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 7 of 10

Schneider Electric Security Notification
General Security Recommendations
We strongly recommend the following industry cybersecurity best practices.
••
•
•
•
•
•
•

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Install physical controls so no unauthorized personnel can access your industrial controland safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the network intended forthat device.
Scan all methods of mobile data exchange with the isolated network such as CDs, USB
drives, etc. before use in the terminals or any node connected to these networks.
Never allow mobile devices that have connected to any other network besides theintended network to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems and ensure thatthey are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs). Recognize that VPNs may have vulnerabilities and should be updated to themost current version available. Also, understand that VPNs are only as secure as theconnected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best
Practices document.

Acknowledgements
Schneider Electric recognizes the following researchers for identifying and helping to coordinatea response to this vulnerability:
CVE

Researchers

CVE-2022-45789

Jos Wetzels and Daniel dos Santos, Forescout Technologies

For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, contact
your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity
Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will befully aware of this situation and can support you through the process.

10-Jan-23 (13-Aug-24)

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 8 of 10

Schneider Electric Security Notification
For further information related to cybersecurity in Schneider Electric’s products, visit thecompany’s cybersecurity support portal page:https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
LEGAL DISCLAIMER
THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALSLINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN
OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS,REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN“AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRICDISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED,INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THEIDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANYDAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDINGDIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIALDAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELYLIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAYRESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHTTO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETIONAbout Schneider Electric
Schneider’s purpose is to empower all to make the most of our energy and resources, bridging progress andsustainability for all. We call this Life Is On.
Our mission is to be your digital partner for Sustainability and Efficiency.
We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloudconnecting products, controls, software and services, across the entire lifecycle, enabling integrated company
management, for homes, buildings, data centers, infrastructure and industries.
We are the most local of global companies. We are advocates of open standards and partnership ecosystems thatare passionate about our shared Meaningful Purpose, Inclusive and Empowered values.
www.se.com

Revision Control:
Version 1.0.0
10 January 2023

Original Release

Version 2.0.0
14 March 2023

Modicon Momentum Unity M1E Process andModicon MC80 were added to the impacted
products with the mitigations.

10-Jan-23 (13-Aug-24)

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 9 of 10

Schneider Electric Security Notification
Version 3.0.0
08 August 2023

All versions of the EcoStruxure™ Process Expert
are impacted by this vulnerability.

Version 4.0.009 January 2024

A remediation is available for Modicon M580.

Version 5.0.0
13 August 2024

A remediation is available for Modicon M580 CPU
Safety (page 2).

CPCERT

10-Jan-23 (13-Aug-24)

Digitally signed by CPCERT
Date: 2024.08.12 12:23:00 -04'00'

Document Reference Number – SEVD-2023-010-06 (v5.0.0)

Page 10 of 10