Schneider Electric Security Notification
Modicon PAC Controllers and PLC Simulator for EcoStruxure™ Control Expert
and EcoStruxure™ Process Expert
10 August 2021 (13 August 2024)

Overview
Schneider Electric is aware of multiple vulnerabilities in the Modicon PAC Controllers and PLC
simulator included in EcoStruxure™ Control Expert and EcoStruxure™ Process Expert.
Modicon PLCs (Programmable Logic Controllers) and PACs (Programmable Automation
Controllers) control and monitor industrial operations in a sustainable, flexible, efficient, andprotected way.
The PLC Simulator feature is part of the EcoStruxure™ Control Expert and EcoStruxure™
Process Expert software and it helps users to review and test their configurations files in asimulation environment and is not intended to be used as a controller CPU in a production
environment.
Failure to apply the mitigations provided below may lead to the execution of a malicious project
file, which could result in loss of availability of the controller or of the PLC simulator. For an
attack to be successful, a malicious project file must be downloaded in the controller or in thesimulator.
August 2024 Update: A remediation is available for Modicon M580 CPU Safety (page 3).

Affected Products and Versions
Product
Modicon M580 CPU (part numbers BMEP* and BMEH*,
excluding M580 CPU Safety), Versions prior to SV4.10
Modicon M580 CPU Safety (part numbers BMEP58*Sand BMEH58*S), Versions prior to SV4.21
Modicon M340 CPU (part numbers BMXP34*), Allversions prior to v3.50
Modicon MC80 (part numbers BMKC80*), All versions
prior to SV1.90
Modicon Momentum Unity M1E Processor (partnumbers 171CBU*), Versions prior to SV2.6
PLC Simulator for EcoStruxure™ Control Expert
Including all Unity Pro versions (former name of
EcoStruxure™ Control Expert), All versions
PLC Simulator for EcoStruxure™ Process Expert
including all HDCS versions (former name of
EcoStruxure™ Process Expert), All versions
Legacy Modicon Premium and Quantum, All versions

CVE202122789

CVE202122790

CVE202122791

CVE202122792

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X

X
X

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 1 of 10

Schneider Electric Security Notification
Vulnerability Details
CVE ID: CVE-2021-22789
CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
vulnerability exists that could cause a Denial of Service on the Modicon PLC controller /simulator when updating the controller application with a specially crafted project file.
CVE ID: CVE-2021-22790
CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-125: Out-of-Bounds Read vulnerability exists that could cause a Denial of Service on the
Modicon PLC controller / simulator when updating the controller application with a speciallycrafted project file.
CVE ID: CVE-2021-22791
CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-787: Out-of-Bounds Write vulnerability exists that could cause a Denial of Service on the
Modicon PLC controller / simulator when updating the controller application with a speciallycrafted project file.
CVE ID: CVE-2021-22792
CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-476: NULL Pointer Dereference vulnerability exists that could cause a Denial of Service
on the Modicon PLC controller / simulator when updating the controller application with a
specially crafted project file.
Note regarding vulnerability details: The severity of vulnerabilities was calculated using theCVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal andEnvironmental metrics. Schneider Electric recommends that customers score the CVSS
Environmental metrics, which are specific to end-user organizations, and consider factors suchas the presence of mitigations in that environment. Environmental metrics may refine therelative severity posed by the vulnerabilities described in this document within a customer’s
environment.

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 2 of 10

Schneider Electric Security Notification
Remediation & Final Mitigations
Affected Product & Version

Remediation

Modicon M340 CPU (partnumbers BMXP34*)
Versions prior to v3.50

M340 v3.50 includes a fix for these vulnerabilities and isavailable for download here:
https://www.se.com/ww/en/download/document/BMXP34xxx
xx_SV_03.50/

Modicon M580 CPU (partnumbers BMEP* and BMEH*,
excluding M580 CPU Safety)
Versions prior to SV4.10

Modicon M580 CPU SV4.10 includes a fix for thesevulnerabilities and is available for download here:
https://www.se.com/ww/en/download/document/BMEx58x0x
0_SV04.10/

Modicon M580 CPU Safety(part numbers BMEP58*Sand BMEH58*S)
Versions prior to SV4.21

Modicon MC80 (BMKC80)
Versions prior to SV1.90

Modicon MOMENTUM CPU(171CBU*)
Versions prior to SV2.6

Legacy Modicon
Quantum/Premium
All versions

Firmware SV4.21 includes a fix for these vulnerabilities andis available for download here:
https://www.se.com/ww/en/product-range/62098-modiconm580-pac-controller/#software-and-firmware
Important: customer needs to use version of EcoStruxure™
Control Expert v16.0 HF001 minimum to connect with thelatest version of M580 CPU Safety. The software is available
for download here:
https://www.se.com/ww/en/product-range/548-ecostruxurecontrol-expert-unity-pro/#software-and-firmware
Firmware SV1.90 includes a fix for CVE-2021-22789
vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/BMKC80_Fir
mware_upgrade/
Firmware SV2.6 includes a fix for CVE-2021-22789
vulnerability and is available for download here:
https://www.se.com/ww/en/download/document/Momentum_
FW_update/
Schneider Electric’s Modicon Premium and Quantum
controllers have reached their end of life and are no longer
commercially available. They have been replaced by the
Modicon M580 ePAC controller, our current product offer.
Customers should strongly consider migrating to the Modicon
M580 ePAC.
Please contact your local Schneider Electric technicalsupport for more information.

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 3 of 10

Schneider Electric Security Notification
Customers should immediately apply the following
mitigations to reduce the risk of exploit:• Download and setup EcoStruxure Control Expert
v15.0 SP1 from this link:
https://www.se.com/ww/en/download/document/EcoS
truxureControlExpert_15SP1
o Use the new “file encryption” feature available
on EcoStruxure™ Control Expert v15.0 SP1 inorder to protect the project files.
o Ensure to use simulator default panel option
to make PLC simulator accessible only locally.
• Store the project files in a secure storage and restrict
the access to only trusted users• When exchanging files over the network, use secure
PLC Simulator forcommunication protocols
EcoStruxure™ Control
Expert including all Unity Pro• Encrypt project files when stored
versions (former name of• Only open project files received from trusted source
EcoStruxure™ Control Expert)• Compute a hash of the project files and regularly
All versions
check the consistency of this hash to verify the
integrity before usage• Harden the workstation running EcoStruxure Control
Expert or Unity Pro
Note: The PLC Simulator feature is part of the EcoStruxure™
Control Expert and EcoStruxure™ Process Expert software,and it helps users to review and test their configurations files
in a simulation environment. It is not intended to be used asa controller CPU in a production environment.
Update: Refer to the PLC Simulator user manual for
more details on enforcing security settings available
here.
Customers should immediately apply the following
mitigations to reduce the risk of exploit:• Store the project files in a secure storage and restrict
the access to only trusted users•
When exchanging files over the network, use secure
PLC Simulator forcommunication protocols
EcoStruxure™ Process
Expert including all HDCS
• Encrypt project files when stored
versions (former name of• Only open project files received from trusted source
EcoStruxure™ Process Expert)• Compute a hash of the project files and regularly
All versions
check the consistency of this hash to verify the
integrity before usage• Harden the workstation running EcoStruxure™
Control Expert or Unity Pro

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 4 of 10

Schneider Electric Security Notification
Note: The PLC Simulator feature is part of the EcoStruxure™
Control Expert and EcoStruxure™ Process Expert software,and it helps users to review and test their configurations files
in a simulation environment. It is not intended to be used asa controller CPU in a production environment.
Update: Refer to the PLC Simulator user manual for
more details on enforcing security settings available
here.
Schneider Electric’s Modicon Premium controllers havereached their end of life and are no longer commerciallyavailable. They have been replaced by the Modicon M580
ePAC controller, our most current product offer.
Customers should strongly consider migrating to the Modicon
M580 ePAC. Please contact your local Schneider Electric
technical support for more information.
Modicon Premium CPU (partnumbers TSXP5*)
All versions

To mitigate the risks users should immediately:• Setup network segmentation and implement a firewall
to block all unauthorized access to port 502/TCP• Configure the Access Control List following therecommendations of the user manual “Premium andAtrium using EcoStruxure™ Control Expert - Ethernet
Network Modules, User Manual” in chapters“Connection configuration parameters / TCP/IP
Services Configuration Parameters / Connection
Configuration Parameters”:
https://www.se.com/ww/en/download/document/35006
192K01000/

Customers should use appropriate patching methodologies when applying these patches totheir systems. We strongly recommend the use of back-ups and evaluating the impact of thesepatches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch.
If customers choose not to apply the remediation provided above, they should immediately
apply the mitigations provided in the table below.

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 5 of 10

Schneider Electric Security Notification
Mitigations
Affected ProductMitigations

Modicon M340 CPU(part numbers
BMXP34*)
Versions prior to
v3.50

•
•
•

Modicon M580 CPU(part numbers
BMEP* and BMEH*
excluding M580
CPU Safety)
Versions prior to
v4.10

Modicon M580 CPU
Safety(part numbers
BMEP58*S and
BMEH58*S)
Versions prior tov4.21
ModiconMOMENTUM Unity
M1E
Processor(171CBU)
Versions prior to v2.6•
Modicon MC80
(BMKC80*)
All versions prior toSV1.90

Setup an application password in the project properties
Setup network segmentation and implement a firewall to block
all unauthorized access to port 502/TCP
Configure the Access Control List following therecommendations of the user manuals:o “Modicon M580, Hardware, Reference Manual”
https://www.se.com/ww/en/download/document/EIO00
00001578/
o “Modicon M340 for Ethernet Communications Modules
and Processors User Manual” in chapter “Messaging
Configuration Parameters”:
https://www.se.com/ww/en/download/document/3100713
1K01000/o “Modicon MC80 Programmable Logic Controller (PLC)
manual” in the chapter “Access Control List (ACL)”
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_
Name=EIO0000002071.02.pdf&p_Doc_Ref=EIO00000
02071
o “Momentum for EcoStruxure™ Control Expert - 171
CBU 78090, 171 CBU 98090, 171 CBU 98091
Processors” manual in the chapter “Modbus
Messaging and Access Control”
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_
Name=HRB44124.08.pdf&p_Doc_Ref=HRB44124
o Use a BMENUA0100 module and follow the
instructions to configure IPSEC feature as described in
the chapter “Configuring the BMENUA0100
Cybersecurity
Settings”: https://www.se.com/ww/en/download/docum
ent/PHA83350
Setup a VPN between the Modicon PLC controller and theengineering workstation containing EcoStruxure™ Control
Expert or Process Expert. Note: this functionality may beprovided by an external IPSEC compatible firewall locatedclose to the controller.

To ensure you are informed of all updates, including details on
affected products and remediation plans, subscribe to Schneider
Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 6 of 10

Schneider Electric Security Notification

Modicon Premium
CPU (part numbers
TSXP5*)All versions

Schneider Electric’s Modicon Premium controllers have reached theirend of life and are no longer commercially available. They have been
replaced by the Modicon M580 ePAC controller, our most current
product offer.
Customers should strongly consider migrating to the Modicon M580
ePAC. Please contact your local Schneider Electric technical support
for more information.
To mitigate the risks users should immediately:• Setup network segmentation and implement a firewall to block
all unauthorized access to port 502/TCP
Configure the Access Control List following the recommendations of
the user manual “Premium and Atrium using EcoStruxure™ Control
Expert – Ethernet Network Modules, User Manual” in chapters“Connection configuration parameters / TCP/IP Services
Configuration Parameters / Connection Configuration Parameters”:
https://www.se.com/ww/en/download/document/35006192K01000/

To ensure you are informed of all updates, including details on affected products andremediation plans, subscribe to Schneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/security-notifications.jsp

General Security Recommendations
We strongly recommend the following industry cybersecurity best practices.
•
•
•
•
•
•
•
•

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Install physical controls so no unauthorized personnel can access your industrial control
and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the network for thedevices that it is intended for.
Scan all methods of mobile data exchange with the isolated network such as CDs, USB
drives, etc. before use in the terminals or any node connected to these networks.
Never allow mobile devices that have connected to any other network besides theintended network to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems and ensure thatthey are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs). Recognize that VPNs may have vulnerabilities and should be updated to themost current version available. Also, understand that VPNs are only as secure as theconnected devices.

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 7 of 10

Schneider Electric Security Notification
For more information refer to the Schneider Electric Recommended Cybersecurity Best
Practices document.

Acknowledgements
Schneider Electric recognizes the following researchers for identifying and helping to coordinate
a response to these vulnerabilities:
CVE

Researchers
Kai Wang (Codesafe Team of Legendsec at Qi’anxin Group)CVE-2021-22789
Guillaume Orlando (Airbus Cybersecurity)CVE-2021-22790
CVE-2021-22791
CVE-2021-22792

Kai Wang (Codesafe Team of Legendsec at Qi’anxin Group)

For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, contact
your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity
Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will befully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit thecompany’s cybersecurity support portal page:https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
LEGAL DISCLAIMER
THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALSLINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN
OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS,REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON
AN “AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRICDISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED,INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE
IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY
DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING
DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL
DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELYLIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 8 of 10

Schneider Electric Security Notification
RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE
RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION

About Schneider Electric
Schneider’s purpose is to empower all to make the most of our energy and resources, bridging progress andsustainability for all. We call this Life Is On.
Our mission is to be your digital partner for Sustainability and Efficiency.
We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloudconnecting products, controls, software and services, across the entire lifecycle, enabling integrated company
management, for homes, buildings, data centers, infrastructure and industries.
We are the most local of global companies. We are advocates of open standards and partnership ecosystems thatare passionate about our shared Meaningful Purpose, Inclusive and Empowered values.
www.se.com

Revision Control:
Version 1.0.0
10 August 2021

Original Release

Version 2.0.0
09 August 2022

A fix is available for Modicon M340 and Modicon
M580 that addresses these vulnerabilities.

Version 2.1.0
06 September 2022

The version number for Modicon M580 that
addresses these vulnerabilities has been updated
from V4.01 to V4.02.

Version 3.0.0
11 October 2022

A clarification added to the list of affected productsby splitting Modicon M580 and Modicon M580
Safety CPU ranges. The purpose of the notification
update is to inform customers that the latest fix
Modicon M580 V4.02 does not apply to the Safety
range of M580. It is highly recommended that
customers using Modicon M580 Safety ranges
continue to implement the mitigations shared in thisdocument.

Version 4.0.0
13 December 2022

The Modicon M580 SV4.02 firmware has been
retracted for quality issues and is no longer
available for download. Additional mitigations havebeen introduced for Modicon M580 CPU and M580

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 9 of 10

Schneider Electric Security Notification
CPU Safety, and we urge customers to deploy
these mitigations to further reduce the risk ofpotential exploitation of identified vulnerabilities.
Version 5.0.0
14 March 2023

A remediation is available for Modicon M580 CPU
and Modicon Momentum Unity M1E Processor for
CVE-2021-22789 (page 3), and update to the PLC
Simulator user manual to reflect the mitigation.

Version 6.0.0
11 July 2023

A remediation is available for Modicon MC80.

Version 7.0.0
13 August 2024

A remediation is available for Modicon M580 CPU
Safety (page 3).

CPCERT

Digitally signed by CPCERT
Date: 2024.08.12 12:38:42 -04'00'

10-Aug-21(13-Aug-24) Document Reference Number – SEVD-2021-222-04 (v7.0.0) Page 10 of 10