Schneider Electric Security Notification
Modicon Controllers
8 October 2019 (13 August 2024)

Overview
Schneider Electric is aware of multiple vulnerabilities in the Modicon Controller products.
August 2024 Update: Remediation for the Modicon M580 CPU Safety is available for download(page 4).

Affected Products & Remediations

2019-6841

2019-6842

2019-6843

2019-6844

2019-6846

2019-6847

CVE-xxxxxxxxxxxx

Modicon M340, Versions prior to SV3.50

xxxxxxModicon BMxCRA and 140CRA modules, all versions

xxxxxxAffected Products and Versions
Modicon M580 (part numbers BMEP* & BMEH*,excluding M580 CPU Safety), Versions prior to SV4.10
Modicon M580 CPU Safety(part numbers BMEP58*S & BMEH58*S), Versions priorto SV4.21

Vulnerability Details
CVE ID: CVE-2019-6841
CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a
Denial of Service of the controller when upgrading the firmware with no firmware image inside thepackage using FTP protocol.

CVE ID: CVE-2019-6842CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a
Denial of Service of the controller when upgrading the firmware with a missing web server
image inside the package using FTP protocol.

8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 1 of 9

Schneider Electric Security Notification
CVE ID: CVE-2019-6843
CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a
Denial of Service of the controller when upgrading the controller with an empty firmware
package using FTP protocol.

CVE ID: CVE-2019-6844
CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a
Denial of Service of the controller when upgrading the controller with a firmware package
containing an invalid web server image using FTP protocol.

CVE ID: CVE-2019-6846
CVSS v3.0 Base Score 5.9 | (Medium) | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could
cause an information disclosure when using the FTP protocol.

CVE ID: CVE-2019-6847
CVSS v3.0 Base Score 4.9 | (Medium) | AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
CWE-755: Improper Handling of Exceptional Conditions vulnerability exists which could cause a
Denial of Service of the FTP service when upgrading the firmware with a version incompatible
with the application in the controller using the FTP protocol.

8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 2 of 9

Schneider Electric Security Notification

Remediation/Mitigations
FTP protocol is inherently unsecure and therefore should be used with care to avoid sensitive
information disclosure and illegal access to the controllers.

Products &Affected Versions

Remediations & Mitigations
Firmware SV4.10 includes a fix for these vulnerabilities and is available fordownload here:
https://www.se.com/ww/en/download/document/BMEx58x0x0_SV04.10/

Modicon M580
CPU (partnumbers BMEP*& BMEH*,excluding M580
CPU Safety)
Versions prior toSV4.10

If customers choose not to apply the remediation then they are encouraged
to immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all
unauthorized access to FTP port 21/TCP on the controllers• Deactivate the FTP service when not needed using Unity Pro /Control Expert software• Change the default FTP password (this procedure should also be
applied after each firmware upgrade of the controller) using Unity /Control Expert in the following menu:“Project Properties / Protection”• When upgrading a firmware in the controller make sure that thefirmware downloaded is compatible with the application alreadyavailable in the controller. If not the case, use Unity Pro / Control
Expert software to rebuild the application of your controller.
• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual”, in chapter “Setup secured
communications”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/• Use a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter “Configuring
the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350• To remove the confidentiality issue from FTP protocol, use a
BMENOC module and follow the instructions to configure IPSEC
feature as described in the guideline “Modicon M580 BMENOC03.1 Ethernet Communications Module, Installation andConfiguration Guide” in the chapter “Configuring IPSECcommunications”:

8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 3 of 9

Schneider Electric Security Notification•

https://www.schneiderelectric.com/en/download/document/HRB62665/
Ensure the CPU is running with the memory protection activated byconfiguring the input bit to a physical input, for more details refer tothe following guideline “Modicon Controllers Platform Cyber
Security Reference Manual”, “CPU Memory Protection section”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/o NOTE: The CPU memory protection cannot be configured
with Hot Standby CPUs. In such cases, use IPsec encrypted
communication

Firmware SV4.21 includes a fix for these vulnerabilities and is available fordownload here:
https://www.se.com/ww/en/product-range/62098-modicon-m580-paccontroller/#software-and-firmware
Important: customer needs to use version of EcoStruxure™ Control Expert
V16.0 HF001 minimum to connect with the latest version of M580 CPU
Safety. The software is available for download here:
https://www.se.com/ww/en/product-range/548-ecostruxure-control-expertunity-pro/#software-and-firmware

Modicon M580
CPU Safety(part numbers
BMEP58*S andBMEH58*S)Versions prior toSV4.21

If customers choose not to apply the remediation then they are encouraged
to immediately apply the following mitigations to reduce the risk of exploit:• Setup network segmentation and implement a firewall to block all
unauthorized access to FTP port 21/TCP on the controllers• Deactivate the FTP service when not needed using Unity Pro /Control Expert software• Change the default FTP password (this procedure should also be
applied after each firmware upgrade of the controller) using Unity /Control Expert in the following menu:“Project Properties / Protection”• When upgrading a firmware in the controller make sure that thefirmware downloaded is compatible with the application alreadyavailable in the controller. If not the case, use Unity Pro / Control
Expert software to rebuild the application of your controller.
• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual”, in chapter “Setup securedcommunications”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/• Use a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter “Configuring

8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 4 of 9

Schneider Electric Security Notification••the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
To remove the confidentiality issue from FTP protocol, use a
BMENOC module and follow the instructions to configure IPSEC
feature as described in the guideline “Modicon M580 BMENOC03.1 Ethernet Communications Module, Installation andConfiguration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.schneiderelectric.com/en/download/document/HRB62665/
Ensure the CPU is running with the memory protection activated byconfiguring the input bit to a physical input, for more details refer tothe following guideline “Modicon Controllers Platform Cyber
Security Reference Manual”, “CPU Memory Protection section”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured
with Hot Standby CPUs. In such cases, use IPsec encrypted
communication

To further reduce the attack surface on Modicon M580 CPU Safety:• Ensure the CPU is running in Safety mode and maintenance input
is configured to maintain this Safety mode during operation – referto the document Modicon M580 - Safety System Planning Guide in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QGH60283/

8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 5 of 9

Schneider Electric Security Notification
Version 3.50 of Modicon M340 includes a fix for the vulnerability and isavailable for download here:
https://www.se.com/ww/en/download/document/BMXP34xxxxx_SV_03.50/
Customers should use appropriate patching methodologies when applying
these patches to their systems. We strongly recommend the use of backups and evaluating the impact of these patches in a Test and Development
environment or on an offline infrastructure. Contact Schneider Electric’s
Customer Care Center if you need assistance removing a patch.
Modicon M340
Versions prior tov3.50

ModiconBMxCRA and140CRA
modules
All versions

If customers choose not to apply the remediation provided above, theyshould immediately apply the following mitigations to reduce the risk ofexploit:• Setup network segmentation and implement a firewall to block all
unauthorized access to FTP port 21/TCP on the controllers• Deactivate the FTP service when not needed.
• Change the default FTP password (this procedure should also be
applied after each firmware upgrade of the controller) using Unity /Control Expert in the following menu: “Project Properties /Protection”• When upgrading a firmware in the controller make sure that thefirmware downloaded is compatible with the application alreadyavailable in the controller. If not the case, use Unity Pro / Control
Expert software to rebuild the application of your controller.
To mitigate the risks associated to the FTP weaknesses, users should
immediately apply the following instructions.
• Setup network segmentation and implement a firewall to block all
unauthorized access to FTP port 21/TCP on the controllers.

Product Information
Ethernet Programmable Automation Controller for industrial process and infrastructure

Product Category – All Categories
Learn more about Schneider Electric’s product categories here: www.schneider-electric.us/en/all-products

How to determine if you are affected
Affected products listed in this security notification connected to an Ethernet network

General Security Recommendations
8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 6 of 9

Schneider Electric Security Notification
We strongly recommend following industry cybersecurity best practices such as:••
••
•••
•

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Physical controls should be in place so that no unauthorized person would have accessto the ICS and safety controllers, peripheral equipment or the ICS and safety networks.
All controllers should reside in locked cabinets and never be left in the “Program” mode.
All programming software should be kept in locked cabinets and should never beconnected to any network other than the network for the devices that it is intended.
All methods of mobile data exchange with the isolated network such as CDs, USBdrives, etc. should be scanned before use in the terminals or any node connected tothese networks.
Laptops that have connected to any other network besides the intended network should
never be allowed to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and/or systems and ensurethat they are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs), recognizing that VPNs may have vulnerabilities and should be updated to themost current version available. Also recognize that VPN is only as secure as theconnected devices.

Acknowledgement
Schneider Electric recognizes the following researchers for identifying and helping to coordinate
a response to these vulnerabilities:
CVE

Researchers

CVE-2019-6843, CVE-2019-6844,CVE-2019-6846, CVE-2019-6841,
CVE-2019-6842

Jared Rittle (Cisco Talos)

CVE-2019-6847

Jared Rittle and Patrick DeSantis (Cisco Talos)

For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, pleasecontact your local Schneider Electric representative and/or Schneider Electric Industrial
Cybersecurity Services. These organizations will be fully aware of this situation and can support
you through the process.
http://www2.schneider-electric.com/sites/corporate/en/support/cybersecurity/cybersecurity.page

8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 7 of 9

Schneider Electric Security Notification
https://www.schneider-electric.com/en/work/services/field-services/industrialautomation/industrial-cybersecurity/industrial-cybersecurity.jsp
Legal Disclaimer
THIS DOCUMENT IS INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION
AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY
RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OF ANY KIND.
SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDINGWARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENTSHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT,INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES,EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
THE USE OF THIS NOTIFICATION, INFORMATION CONTAINED HEREIN, OR MATERIALS LINKED TOIT ARE AT YOUR OWN RISK. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE ORCHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION.
About Schneider Electric
Schneider’s purpose is to empower all to make the most of our energy and resources, bridging progress andsustainability for all. We call this Life Is On.
Our mission is to be your digital partner for Sustainability and Efficiency.
We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloudconnecting products, controls, software and services, across the entire lifecycle, enabling integrated company
management, for homes, buildings, data centers, infrastructure and industries.
We are the most local of global companies. We are advocates of open standards and partnership ecosystems thatare passionate about our shared Meaningful Purpose, Inclusive and Empowered values.
www.se.com

Revision Control:
Version 1.0.0
26 Sep 2019

Original Release

Version 2.0.0
10 Dec 2019

Fix now available for M580 firmware version 3.10
for CVE-2019-6841, CVE-2019-6843, CVE-20196844 (pages 1-2,4-5)

Version 2.1.0
15 April 2021

Updated CWE for:• CVE-2019-6841• CVE-2019-6842• CVE-2019-6843• CVE-2019-6844• CVE-2019-6847

8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 8 of 9

Schneider Electric Security Notification

Version 3.0.0
09 August 2022

A fix is available in Modicon M580 V4.01 that
addresses vulnerabilities related to FTP. The FTP
protocol was previously required during thefirmware upgrade process, it has now been
replaced by the HTTPS protocol.

Version 3.1.0
06 September 2022

The version number for Modicon M580 that
addresses these vulnerabilities has been updated
from SV4.01 to SV4.02.

Version 4.0.0
11 October 2022

A clarification was added to the list of affected
products by splitting Modicon M580 and Modicon
M580 Safety CPU ranges. The purpose of thenotification update is to inform customers that thelatest fix Modicon M580 SV4.02 does not apply to
the Safety range of M580. It is highly
recommended that customers using Modicon
M580 Safety ranges continue to implement themitigations shared in this document.

Version 5.0.0
13 December 2022

The Modicon M580 SV4.02 firmware has beenretracted for quality issues and is no longer
available for download. Additional mitigations havebeen introduced for Modicon M580 CPU andM580 CPU Safety, and we urge customers todeploy these mitigations to further reduce the riskof potential exploitation of identified vulnerabilities.

Version 6.0.0
14 March 2023

Remediation for the Modicon M580 CPU isavailable for download.

Version 7.0.0
13 August 2024

A remediation is available for the Modicon M580
CPU Safety (page 4).

CPCERT

Digitally signed by CPCERT
Date: 2024.08.12 12:55:25 -04'00'8-Oct-19 (13-Aug-24) Document Reference Number – SEVD-2019-281-02 v7.0.0

Page 9 of 9