Schneider Electric Security BulletinWind River VxWorks Vulnerabilities (URGENT/11)
2 August 2019 (13 September 2022)

Overview
Wind River’s VxWorks TCP/IP Stack vulnerabilities have wide-ranging impact across multiple IT andindustrial applications. We are working closely with Wind River to understand and assess how thesevulnerabilities impact Schneider Electric offers and our customers’ operations. We downloaded Wind
River’s patches as soon as they were made available to us, and we have quickly instituted aremediation plan to evolve all current and future products that rely on the Wind River platform toembed these fixes.
We will continue to monitor and will respond further if new information becomes available. In themeantime, customers should immediately make sure they have implemented cybersecurity bestpractices across their operations to protect themselves from these vulnerabilities. Where appropriate
this includes locating your industrial systems and remotely accessible devices behind firewalls;
installing physical controls to prevent unauthorized access; and preventing mission-critical systems
and devices from being accessed from outside networks.
Please subscribe to the Schneider Electric security notification service to be informed of updates tothis disclosure, including details on affected products and remediations, as well as other important
security notifications:
https://www.schneider-electric.com/en/work/support/cybersecurity/security-notifications.jsp
For additional information and support, please contact your Schneider Electric sales or service
representative or Schneider Electric’s Customer Care Center.
Note: Schneider Electric is aware of a potential exploit available that targets the URGENT/11
vulnerabilities. Our customers should urgently consider applying the remediations or mitigations
detailed in this document.
September 2022 Update: CANopen X80 Communication Module (BMECXM0100) (page 2) andProfibus Remote Master (TCSEGPA23F14F) (page 7) added to the list of affected products, alongwith their final mitigations.

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 1 of 14

Schneider Electric Security Bulletin
Details
Additional details on these specific vulnerabilities can be found on the Wind River security notification
webpage:https://www.windriver.com/security/announcements/tcp-ip-network-stack-ipnet-urgent11/
Of the 11 identified Wind River vulnerabilities, six have the potential to trigger remote code execution.
Four of those six can be mitigated by a specific firewall configuration, even if access to the device isrequired. The other vulnerabilities can trigger denial of service conditions or information disclosure.
Important to note, not all vulnerabilities apply to all impacted versions.

Affected Products, Remediations, and Mitigations
Remediating these vulnerabilities requires Schneider Electric to update affected products’ firmware.
Customers cannot directly apply Wind River patches.
We have downloaded Wind River’s patches and have established remediation plans to ensure all
current and future Schneider Electric products that rely on the Wind River platform evolve with theseembedded fixes. Integrating and validating Wind River’s patches requires thorough testing andpossibly recertification to ensure the quality of the updated product.
This bulletin will be updated as remediations become available. For all other affected products,
customers should refer to mitigations to reduce risk to their installations.

Available Remediations
Industrial Automation Products

CANopen X80 Communication
Module (BMECXM0100)

2-Aug-19 (13-Sep-22)

Affected Version

Remediation

All versions

Customers should immediately apply
the mitigations proposed in the
mitigation section of this document
and in the Cybersecurity Reference
Manual to reduce the risk of exploit:
https://www.se.com/ww/en/download/document/EIO0000001999/

Document Reference Number – SESB-2019-214-01 V2.14

Page 2 of 14

Schneider Electric Security Bulletin
ConneXium Industrial Firewall/
Router- TCSEFEC2CF3F21(MM/TX)- TCSEFEC23FCF21(TX/MM)
TCSEFEC23F3F21 (TX/TX)

V5.33 and prior

Software Version 5.37 available
here:
https://www.schneiderelectric.com/en/download/document/
TCSEFEC23FxF21/

ConneXium Industrial Firewall- TCSEFEC2CF3F20(MM/TX)- TCSEFEC23FCF20(TX/MM)- TCSEFEC23F3F20 (TX/TX)

V5.24 and prior

These models have reached theirend of life in January 2015 and are
no longer commerciallyavailable. Please apply
the mitigations proposed and/or
upgrade to current models. Contact
your local technical support for more
information.

E+PLC100 Combination PLC

V1.2.0.4 firmware andprior

E+PLC400 Combination PLC

V1.2.0.4 firmware andprior

HMIGXU

V1.1.0.32 and prior

Magelis HMI - HMIGTO Series,
HMISCU Series, HMIGTUX
Series, and HMIGTU Series(Except Open BOX)

Vijeo Designer V6.2
SP9 and prior

2-Aug-19 (13-Sep-22)

Contact your local Eurotherm
technical support to get firmware
V1.3.0.0.
Contact your local Eurotherm
technical support to get firmware
V1.3.0.0.
Contact your local technical support
to get the Vijeo Basic runtime
V1.1.0.4404 software
Contact your local technical support
to get the Vijeo Designer V6.2 SP9HotFix1 Alpha4.

Document Reference Number – SESB-2019-214-01 V2.14

Page 3 of 14

Schneider Electric Security Bulletin
BMEAHI0812:
https://www.se.com/ww/en/download/document/BMEAHI0812_Firmware_
upgrade/Modicon X80 I/O modules:- Modicon X80 BMEAHI0812
HART Analog Input Module- Modicon X80 BMEAHO0412
HART Analog Output Module- Modicon Network Option Switch
BMENOS0300 (C)- I/O Drop Adapters –BMXCRA31200,
BMXCRA31210 (C),BMECRA31210 (C)- BMEAHI0812 and

BMEAHO0412:
V1.30 and prior- BMENOS0300 (C):V1.01 and prior- BMXCRA31200,

BMXCRA31210 (C),and BMECRA31210(C): V2.40 and prior

BMEAHO0412:
https://www.se.com/ww/en/download/document/BMEAHO0412_Firmware_upgrade/
BMENOS0300 (C):https://www.se.com/ww/en/download/document/BMENOS0300_Firmware_/
BMXCRA31200:
https://www.se.com/ww/en/download/document/BMXCRA31200_FW_and_FW_History
BMXCRA31210 (C):https://www.se.com/ww/en/download/document/BMXCRA31210_FW_and_FW_History
BMECRA31210 (C):https://www.se.com/ww/en/download/document/BMECRA31210_FW_and_FW_History

Modicon LMC078 Controller

Modicon M241 Micro PLC

2-Aug-19 (13-Sep-22)

V1.51.15.05 and prior

Firmware update is available throughSchneider Electric Software Update(SESU). Download the SESU clienthere
https://www.seupdate.schneiderelectric.com/download/SystemConsis
tency/SoftwareUpdate/SESU_231/S
ESU_2.3.1_setup_sfx.exe

Firmware versions prior
to V5.1.9.14

Firmware is available through SESU
update or in Machine Expert 2.0
available in the following link:
https://www.se.com/ww/en/productrange-download/2226-ecostruxuremachine-expert/#/software-firmwaretab

Document Reference Number – SESB-2019-214-01 V2.14

Page 4 of 14

Schneider Electric Security Bulletin

Modicon M251 Micro PLC

Modicon M262 Logic/Motion
Controller

Modicon M580 Ethernet
Communications Modules

Modicon M580 Ethernet
communications Modules
Modicon M580 IEC 61850 BMENOP0300 (C)Modicon M580 ePAC CPUs
including Safety CPUs

2-Aug-19 (13-Sep-22)

Firmware versions prior
to V5.1.9.14

Firmware is available through SESU
update or in Machine Expert 2.0
available in the following link:
https://www.se.com/ww/en/productrange-download/2226-ecostruxuremachine-expert/ - /softwarefirmware-tab

Firmware V5.0.3.2 andprior

Firmware update is the Schneider
Electric Software Update (SESU).
Download the SESU client here
https://www.update.schneiderelectric.com/download/SystemConsis
tency/SoftwareUpdate/SESU_220/S
ESU_2.2.0_setup_sfx.exe

Modicon M580
EthernetCommunications
Modules:
BMENOC0301
BMENOC0311
BMENOC0321

BMENOC0301:
https://www.se.com/ww/en/download/document/BMENOC0311+Exec+an
d+Release+Notes/
BMENOC0311: https://www.se.com/
ww/en/download/document/BMENO
C0301+Exec+and+Release+Notes/
BMENOC0321:
https://www.se.com/ww/en/download/document/BMENOC0321_Firmware/

V2.1 and prior

A fix is available in version 2.2:https://www.se.com/ww/en/product/B
MENOP0300/m580-iec-61850communication-module/

M580 V2.90 and prior

A fix is available on Modicon M580
firmware V3.10, find links to fixedversions in the Download Links
sectionDocument Reference Number – SESB-2019-214-01 V2.14

Page 5 of 14

Schneider Electric Security Bulletin

Modicon MC80 Programmable
Logic Controller

V1.4 and prior

A fix is available in V1.5:
https://www.se.com/ww/en/productrange-download/62396-modiconmc80/?filter=business-1-industrialautomation-and-control#/softwarefirmware-tab

Modicon Momentum Unity

V2.01 and prior

A fix is available in SV2.10 https://www.se.com/ww/en/download/document/Momentum_FW_update/

Modicon Quantum Ethernet DIO
network module - 140NOC78x00(C)

All versions

Modicon Quantum 140 CRA

V2.40 and prior

Modicon Quantum Head 140
CRP module - 140CRP31200 (C)Modicon Quantum 140 NOPCommunications Module

2-Aug-19 (13-Sep-22)

These models have reached theirend of life. Please apply the
mitigations proposed and/or upgrade
to Modicon M580 offer. Contact yourlocal technical support for more
information.
A fix is available in V2.50, available
here for:
140CRA31200
https://www.se.com/ww/en/download/document/_140CRA31200_FW_and_FW_History
140CRA31908
https://www.se.com/ww/en/download/document/_140CRA31908_FW_and_FW_History

All versions

These models have reached theirend of life. Please apply the
mitigations proposed and/or upgrade
to Modicon M580 offer. Contact yourlocal technical support for more
information.

All versions

These models have reached theirend of life in December 2018 and are
no longer commerciallyavailable. Please apply
the mitigations proposed and/or
upgrade to IEC 61850
communication module
BMENOP0300. Contact your local
technical support for more
information.

Document Reference Number – SESB-2019-214-01 V2.14

Page 6 of 14

Schneider Electric Security Bulletin

V8.14 and prior

A fix is available in V8.16:
https://www.eurotherm.com/?wpdmdl=28419V1.62.5.6 and prior

Firmware is available in Machine
Expert 1.2 available in the following
link:
https://www.se.com/ww/en/productrange-download/2226-ecostruxuremachine-expert/#/software-firmwaretab

Profibus Remote Master(TCSEGPA23F14F)

All versions

Customers should immediately apply
the mitigations proposed in the
mitigation section of this document
and in the Cybersecurity Reference
Manual to reduce the risk of exploit:
https://www.se.com/ww/en/download/document/EIO0000001999/

Pro-face HMI -GP4000H/R/E
Series, GP4100 Compact Series,
LT4000M Modular Series,
GP4000E Series, IoT Gateway,
SP5000 Series, and SP5000X
SeriesGP-ProEX V4.09.100
and prior (HMI version
is dependent on using
GP-Pro EX version)

Firmware update is available through
GP-Pro EX software. GP-Pro EX isavailable in the following link:
https://www.proface.com/en/downloa
d/update/gpproex/v409

SCADAPack 53xE RTUs

V8.14.7 and priorContact your local technical support
or email supportTRSS@se.com forthe latest version.

SCADAPack 57x RTUs

V9.2.3 and earlier

Contact your local technical support
or email supportTRSS@se.com forthe latest version.

SCD6000 Industrial RTU

V7.0.34
SY-1101207_G17 andprior

A fix is available in V7.0.36 SY1101207_G18. Contact your local
technical support for more
information.

Tricon Communication Modules

TCM/TCM2 V11.1 V11.4

Contact your local technical support:
https://pasupport.schneiderelectric.com/

Nanodac Recorder / Controller

PacDrive 3 Eco/Pro/Pro2 Motion
Controllers

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 7 of 14

Schneider Electric Security Bulletin
Trident Communication
Integration Module

V3.0

Contact your local technical support:
https://pasupport.schneiderelectric.com/

versadac™ Scalable Data
RecorderV2.37 firmware version
and priorContact your local Eurotherm
technical support to obtain firmware
V2.41.

Energy Management Products

Affected Version

Remediation

Versions prior
to D5.24 –C264 D5.X[For PACiS (ESO) 6.3]

Easergy MiCOM C264

Versions prior
to 1.79 –C264 D1.X[For PACiS (ESO) 5.2]

Contact your local technical support
or the Energy Application Center(EAC) for assistance in upgrading to
the new version.

Versions prior
to D4.25 –C264 D4.X[For PACiS (ESO) 6.1]

Easergy MiCOM P30

P30 with rejuvenated
Ethernet board
CORTEC with v66x;
v670

Contact your local technical support
or the Energy Application Center(EAC) for assistance in upgrading to
the new version

Easergy MiCOM Px40

All P40 withrejuvenated Ethernet
board
CORTEC with digit 7=
Q, R or S

Contact your local technical support
or the Energy Application Center(EAC) for assistance in upgrading to
the new version

Easergy P5

Firmware version: V01
Release: 001.029
Date: 29th May 2019

Firmware version: V01 Release:
200.008 Release date: 15th Nov
2019 Please Contact your local
technical support for assistance.

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 8 of 14

Schneider Electric Security Bulletin

Easergy T300 (SC150 & LV150)

Firmware 1.5.2 andearlierContact your local technical support
or the Energy Application Center(EAC) for assistance in upgrading to
the new version – 2.7.

ION7400

V2.1.0 and earlier

https://www.se.com/us/en/download/
document/ION7400_meter_FW_v00
2.002.001/
V002.002.001

ION7400 MID(METSEION74001)

V002.100.000 firmware
version and earlier

ION9000

V2.1.0 and earlier

https://www.se.com/us/en/download/
document/ION9000_meter_FW_v00
2.002.001/

PM8000V2.1.0 and earlier

https://www.se.com/us/en/download/
document/PM8000_meter_FW_v002.002.001/

https://www.se.com/ca/en/download/
document/ION7400_MID_meter_FW_v2.2.1/

V002.002.001
PM8000 MID (METSEPM82401)

V002.100.000 firmware
version and earlier

SAGE RTU

K3 firmware and earlier
for C3414 CPU

Saitel DR with HU_A CPU

V11.04.17 and earlier.

TeSys island

2-Aug-19 (13-Sep-22)

Version TeSysisland_0
01.100.013.sedp (01.0100)

https://www.se.com/ca/en/download/
document/PM8000_MID_meter_FW_
v2.2.1/
https://www.sagertu.com/updates/c3414-500-s02k4firmware-release
Contact your local technical support
or the Energy Application Center(EAC) for assistance in upgrading to
the new version.
Download version
TeSysisland_002.100.013.sedp (02.0100) or later version.
Download link:
https://www.se.com/us/en/download/
document/TeSysisland_002.100.013.
zip/ (also available via SoMove with
the installed DTM)

Document Reference Number – SESB-2019-214-01 V2.14

Page 9 of 14

Schneider Electric Security Bulletin
Mitigations
Since the vulnerabilities are present in the TCP/IP stack of the VxWorks product, an active network
connection is required to exploit them. Therefore, Schneider Electric customers can act now to
mitigate the risk of attack by limiting access to their devices, which would immediately reduce
attempted exploits:
•
•
•
•
•
•

Limit access to the networks on which Schneider Electric devices are placed.
Do not expose Schneider Electric devices directly to the internet.
Restrict external network connectivity to the affected devices.
Always place Schneider Electric devices behind firewalls and/or other security protection
appliances that limit access only to authorized remote connections.
Continually monitor affected devices for security events that could warn of attempted
unauthorized access.
Limit access to internal networks where devices reside.

For more details and assistance on how to protect your installation, please contact your local
Schneider Electric’s Industrial Cybersecurity Services organization, which is fully aware of thissituation and can support you through the process.

Download Links
M580 V3.10 Firmware
BMEP584040

https://www.schneiderelectric.com/en/download/document/M580_BMEP584040_SV3.10/

BMEH584040 and C

https://www.schneiderelectric.com/en/download/document/M580_BMEH584040_SV3.10/

BMEP586040 and C

https://www.schneiderelectric.com/en/download/document/M580_BMEP586040_SV3.10/

BMEH586040 and C

https://www.schneiderelectric.com/en/download/document/M580_BMEH586040_SV3.10/

BMEP581020 and H

https://www.schneiderelectric.com/en/download/document/M580_BMEP581020_SV3.10/

BMEP582020 and H

https://www.schneiderelectric.com/en/download/document/M580_BMEP582020_SV3.10/

BMEP582040 and H

https://www.schneiderelectric.com/en/download/document/M580_BMEP582040_SV3.10/

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 10 of 14

Schneider Electric Security Bulletin
BMEP583020

https://www.schneiderelectric.com/en/download/document/M580_BMEP583020_SV3.10/

BMEP583040

https://www.schneiderelectric.com/en/download/document/M580_BMEP583040_SV3.10/

BMEP584020

https://www.schneiderelectric.com/en/download/document/M580_BMEP584020_SV3.10/

BMEP585040 and C

https://www.schneiderelectric.com/en/download/document/M580_BMEP585040_SV3.10/

BMEH582040 and C

https://www.schneiderelectric.com/en/download/document/M580_BMEH582040_SV3.10/

BMEP584040S

https://www.schneiderelectric.com/en/download/document/M580_BMEP584040S_SV3.10/

BMEH584040S

https://www.schneiderelectric.com/en/download/document/M580_BMEH584040S_SV3.10/

BMEH586040S

https://www.schneider-electric.com/en/download/document/M580_BMEH586040S_SV3.10/

BMEP582040S

https://www.schneiderelectric.com/en/download/document/M580_BMEP582040S_SV3.10/

Additional Security Recommendations
We also strongly recommend applying the following industry cybersecurity best practices:
•
•
•
•
•
•
•

Locate control and safety system networks and remote devices behind firewalls and isolate themfrom the business network.
Physical controls should be in place so that no unauthorized person would have access to the ICS
and safety controllers, peripheral equipment or the ICS and safety networks.
All controllers should reside in locked cabinets and never be left in the “Program” mode.
All programming software should be kept in locked cabinets and should never be connected to
any network other than the network for the devices that it is intended.
All methods of mobile data exchange with the isolated network such as CDs, USB drives, etc.
should be scanned before use in the terminals or any node connected to these networks.
Laptops that have connected to any other network besides the intended network should never beallowed to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and/or systems and ensure that they
are not accessible from the Internet.

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 11 of 14

Schneider Electric Security Bulletin•

When remote access is required, use secure methods, such as Virtual Private Networks (VPNs),
recognizing that VPNs may have vulnerabilities and should be updated to the most current
version available. Also recognize that VPN is only as secure as the connected devices.

For More Information
This document provides an overview of recently disclosed Wind River VxWorks vulnerabilities andactions required to mitigate them.
For more details and assistance on how to protect your installation, please contact your local
Schneider Electric representative and/or Schneider Electric Industrial Cybersecurity Services. These
organizations will be fully aware of this situation and can support you through the process.
http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page
https://www.schneider-electric.com/en/work/services/field-services/industrial-automation/industrialcybersecurity/industrial-cybersecurity.jsp
Legal Disclaimer
THIS DOCUMENT IS INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND
SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND
IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OF ANY KIND. SCHNEIDER ELECTRIC DISCLAIMS ALL
WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR
A PARTICULAR PURPOSE. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGESWHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR
SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. THE USE OF THIS NOTIFICATION, INFORMATION CONTAINED HEREIN, OR MATERIALS LINKED TO IT
ARE AT YOUR OWN RISK. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THISNOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION.
About Schneider Electric
Schneider’s purpose is to empower all to make the most of our energy and resources, bridging progress and sustainability
for all. We call this Life Is On.
Our mission is to be your digital partner for Sustainability and Efficiency.
We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloud connecting
products, controls, software and services, across the entire lifecycle, enabling integrated company management, for homes,
buildings, data centers, infrastructure and industries.
We are the most local of global companies. We are advocates of open standards and partnership ecosystems that are
passionate about our shared Meaningful Purpose, Inclusive and Empowered values.
www.se.com

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 12 of 14

Schneider Electric Security Bulletin
Revision Control:
Version 1
02-Aug-2019

Original Release

Version 1.1
07-Aug-2019

Added Modicon LMC078 Controller to list of affected products, and removed aduplicate product.

Version 1.2
09-Aug-2019

Added SAGE RTU to list of affected products.

Version 1.3
19-Aug-2019

Removed Modicon M580 Ethernet / Serial RTU Module and added Modicon eX80 BMEAHI0812 HART Analog Input Module to list of affected products.

Version 1.4
29-Aug-2019

Updated affected versions for Easergy MiCOM C264 product.

Version 2.0
11-Oct-2019- Exploit information added to Overview Section- Remediations added for SAGE RTU, Easergy MiCOM C264, and SCADAPack
57x RTUs- Updated affected versions for Easergy MiCOM P40

Version 2.1
17-Oct-2019

Updated affected versions for SCADAPack 57x RTUs and SAGE RTU under
Available Remediations.

Version 2.2
12-Nov-2019

Updated remediations for ConneXium Industrial Firewall, Easergy MiCOM C264
Controller (page 2-3)
Enhanced product list with additional details for Modicon X80 I/O modules. Added
Modicon Quantum Head 140 CRP, Modicon Momentum Unity, and removed
TMSES4 Ethernet Module from affected products.

Version 2.3
13-Nov-2019

Updated remediations for Modicon M262 Logic/Motion Controller (page 3)

Version 2.4
10-Dec-2019

Updated remediations for Modicon M580 Ethernet Communications Modules,
Modicon M580 ePAC CPUs including Safety CPUs, Easergy P5, ION7400,
ION9000, PM8000.

Version 2.5
14-Jan-2020

Updated remediations for Modicon X80 I/O modules, Modicon Momentum Unity,
Nanodac Recorder / Controller (added to affected products), SCADAPack 53xE
RTUs, and Saitel DR with HU_A CPU.

Version 2.6
11-Feb-2020

Updated remediations for Modicon LMC078 Controller, Modicon M580 Ethernet
communications Modules: Modicon M580 IEC 61850 - BMENOP0300 (C), Modicon
MC80 Programmable Logic Controller, Modicon Quantum 140 NOPCommunications Module, PacDrive 3 Eco/Pro/Pro2 Motion Controllers, Pro-face

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 13 of 14

Schneider Electric Security Bulletin
HMI -GP4000H/R/E Series, GP4100 Compact Series, LT4000M Modular Series,
GP4000E Series, IoT Gateway, SP5000 Series, and SP5000X Series, Easergy
MiCOM Px40, and TeSys island.
Version 2.7
11-Mar-2020

Updated remediations for HMIGXU, Easergy MiCOM P30, Tricon Communication
Modules, Trident Communication Integration Module.

Version 2.8
14-Apr-2020

Updated remediations for ION7400 MID and PM8000 MID.

Version 2.9
12-May-2020

Updated remediations for Modicon Network Option Switch, Modicon X80 - I/O Drop
Adapters, Modicon Quantum 140 CRA, Modicon Quantum Head 140 CRP, andModicon Quantum Ethernet DIO network module - 140NOC78x00 (C), SCD6000
Industrial RTU, Pro-face HMI -GP4000H/R/E Series.

Version 2.10
21-May-2020

Clarified “Affected Version” and “Remediation” version reference numbers for
SCD6000 Industrial RTU product.

Version 2.11
09-Jun-2020

Updated remediations for Easergy T300 and Magelis HMI - HMIGTO Series,
HMISCU Series, HMIGTUX Series, and HMIGTU Series (Except Open BOX)products.

Version 2.12
13-Oct-2020

Updated remediations for versadac™ Scalable Data Recorder, E+PLC100
Combination PLC, and E+PLC400 Combination PLC products.

Version 2.13
11-May-2021

Updated remediations for Modicon M241 Micro PLC and Modicon M251 Micro
PLC.

Version 2.14
12-Sep-2022

CANopen X80 Communication Module (BMECXM0100) (page 2) and Profibus
Remote Master (TCSEGPA23F14F) (page 7) added to the list of affected products,
along with their final mitigations.

signed by Product Security Office
Product Security Office Digitally
Date: 2022.09.12 10:43:31 -04'00'

2-Aug-19 (13-Sep-22)

Document Reference Number – SESB-2019-214-01 V2.14

Page 14 of 14