Schneider Electric Security Notification
Modicon Controllers M241/ M251, M258 / LMC058 and M262
9 July 2024 (13 August 2024)

Overview
Schneider Electric is aware of a vulnerability in its Modicon Controllers M241 / M251, M258 /LMC058, and M262 products.
The Modicon Controllers M241 / M251 / M258 / M262 and Modicon Motion Controller LMC058
are Programmable Logic Controllers for performance-demanding applications.
Failure to apply the remediation provided below may risk a Cross-site Scripting or an open
redirect attack which could result in an account takeover scenario or the execution of code inthe user browser.
August 2024 Update: A remediation is now available for Modicon Controllers M262 and M241 /M251.

Affected Products and Versions
ProductVersion

Modicon Controllers M241 / M251

Version prior to v5.2.11.24

Modicon Controllers M258 / LMC058

All versions

Modicon Controllers M262

Versions prior to v5.2.8.26

Vulnerability Details
CVE ID: CVE-2024-6528
CVSS v3.1 Base Score 5.4 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting
condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a
page containing the injected payload.
Note regarding vulnerability details: The severity of vulnerabilities was calculated using theCVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal andEnvironmental metrics. Schneider Electric recommends that customers score the CVSS
Environmental metrics, which are specific to end-user organizations, and consider factors such
9-Jul-24 (13-Aug-24) Document Reference Number – SEVD-2024-191-04 (v2.0.0) Page 1 of 6

Schneider Electric Security Notification
as the presence of mitigations in that environment. Environmental metrics may refine therelative severity posed by the vulnerabilities described in this document within a customer’senvironment.

Remediation
Affected Product & Version

Remediation
Modicon Controller M241 Firmware version 5.2.11.24
delivered with EcoStruxure™ Machine Expert v2.2.2
includes a fix for this vulnerability and can be updated
through the Schneider Electric Software Update (SESU)
application.

Modicon Controller M241Version prior to v5.2.11.24

https://www.se.com/ww/en/product-range/2226ecostruxure-machine-expert-software/On the engineering workstation, update to v2.2.2 of
EcoStruxure™ Machine Expert.
Update Modicon Controller M241 to the latest Firmware andperform reboot
Modicon Controller M251 Firmware version 5.2.11.24
delivered with EcoStruxure™ Machine Expert v2.2.2
includes a fix for this vulnerability and can be updated
through the Schneider Electric Software Update (SESU)
application.

Modicon Controller M251
Version prior to v5.2.11.24

https://www.se.com/ww/en/product-range/2226ecostruxure-machine-expert-software/On the engineering workstation, update to v2.2.2 ofEcoStruxure™ Machine Expert.
Update Modicon Controller M251 to the latest Firmware andperform reboot

Modicon Controller M262
Version prior to v5.2.8.26

Modicon Controller M262 Firmware version 5.2.8.26
delivered with EcoStruxure™ Machine Expert v2.2.2
includes a fix for this vulnerability and can be updated
through the Schneider Electric Software Update (SESU)
application.

9-Jul-24 (13-Aug-24) Document Reference Number – SEVD-2024-191-04 (v2.0.0) Page 2 of 6

Schneider Electric Security Notification

https://www.se.com/ww/en/product-range/2226ecostruxure-machine-expert-software/On the engineering workstation, update to v2.2.2 ofEcoStruxure™ Machine Expert.
Update Modicon Controller M262 to the latest Firmware
and perform reboot

Customers should use appropriate patching methodologies when applying these patches totheir systems. We strongly recommend the use of back-ups and evaluating the impact of thesepatches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately
apply the following mitigations to reduce the risk of exploit:

9-Jul-24 (13-Aug-24) Document Reference Number – SEVD-2024-191-04 (v2.0.0) Page 3 of 6

Schneider Electric Security Notification

Mitigations
Affected Product & Version

Mitigations
Customers should immediately apply the following
mitigations to reduce the risk of exploit:•••
Modicon Controllers M241 /M251, M258, M262, andModicon Motion Controller
LMC058••All versions••

Use controllers and devices only in a protectedenvironment to minimize network exposure andensure that they are not accessible from public
internet or untrusted networks.
Ensure usage of user management and password
features. User rights are enabled by default andforced to create a strong password at first use.
Deactivate the Webserver after use when notneeded.
Use encrypted communication links.
Setup network segmentation and implement a
firewall to block all unauthorized access to ports
80/HTTP and 443/HTTPS.
Use VPN (Virtual Private Networks) tunnels if
remote access is required.
The “Cybersecurity Guidelines for EcoStruxure
Machine Expert, Modicon and PacDrive Controllers
and Associated Equipment” provide product specifichardening guidelines.

To ensure you are informed of all updates, including details
on affected products and remediation plans, subscribe toSchneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

General Security Recommendations
We strongly recommend the following industry cybersecurity best practices.
•••

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Install physical controls so no unauthorized personnel can access your industrial control
and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.

9-Jul-24 (13-Aug-24) Document Reference Number – SEVD-2024-191-04 (v2.0.0) Page 4 of 6

Schneider Electric Security Notification
••
•
•
•

Never connect programming software to any network other than the network intended forthat device.
Scan all methods of mobile data exchange with the isolated network such as CDs, USBdrives, etc. before use in the terminals or any node connected to these networks.
Never allow mobile devices that have connected to any other network besides theintended network to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems and ensure thatthey are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs). Recognize that VPNs may have vulnerabilities and should be updated to themost current version available. Also, understand that VPNs are only as secure as theconnected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best
Practices document.

For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, contact
your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity
Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will befully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit thecompany’s cybersecurity support portal page:https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

LEGAL DISCLAIMER
THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALSLINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN
OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS,REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN“AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRICDISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED,INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THEIDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANYDAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDINGDIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIALDAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELYLIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY

9-Jul-24 (13-Aug-24) Document Reference Number – SEVD-2024-191-04 (v2.0.0) Page 5 of 6

Schneider Electric Security Notification
RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHTTO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION.

About Schneider Electric
Schneider’s purpose is to create Impact by empowering all to make the most of our energy and resources,
bridging progress and sustainability for all. We call this Life Is On.
Our mission is to be the trusted partner in Sustainability and Efficiency.
We are a global industrial technology leader bringing world-leading expertise in electrification, automation anddigitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive
homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT
solutions with connected products, automation, software and services, delivering digital twins to enable profitable
growth for our customers.
We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating inover 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in
everything we do, guided by our meaningful purpose of a sustainable future for all.
www.se.com

Revision Control:
Version 1.0.0
09 July 2024

Version 2.0.0
13 August 2024

CPCERT

Original Release
A remediation is now available for Modicon
Controllers M262 and M241 / M251.

Digitally signed by CPCERT
Date: 2024.08.12 12:15:21 -04'00'

9-Jul-24 (13-Aug-24) Document Reference Number – SEVD-2024-191-04 (v2.0.0) Page 6 of 6