Schneider Electric Security Notification
EcoStruxure™ Control Expert, EcoStruxure™ Process Expert andModicon PLCs and PACs
10 January 2023 (13 August 2024)

Overview
Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert ,EcoStruxure™ Process Expert and Modicon PLCs (Programmable Logic Controllers) and PACs
(Programmable Automation Controllers).
Modicon PLCs and PACs control and monitor industrial operations. EcoStruxure™ Control
Expert is the common programming, debugging and operating software for Modicon PLCs and
PACs. EcoStruxure™ Process Expert DCS is a single automation system to engineer, operate,
and maintain an entire plant Infrastructure.
Failure to apply the remediations provided below may risk unauthorized access to your PLC,
which could result in the possibility of denial of service and loss of confidentiality, integrity of thecontroller.
August 2024 Update: A remediation is available for the Modicon M580 CPU Safety (page 2).

Affected Products and Versions
Product

VersionEcoStruxure™ Control Expert

Versions prior to V15.3

EcoStruxure™ Process Expert

All versions

Modicon M340 CPU (part numbers BMXP34*)

Version prior to SV3.51

Modicon M580 CPU (part numbers BMEP* and BMEH*)

Versions prior to SV4.10

Modicon M580 CPU Safety (part numbers BMEP58*S and
BMEH58*S)

Versions prior to SV4.21

Modicon Momentum Unity M1E Processor (171CBU*)

Versions prior to SV2.6

Modicon MC80 (BMKC80*)

Versions prior to SV1.90

Legacy Modicon Quantum (140CPU65*) andPremium CPUs (TSXP57*)

All versions

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 1 of 11

Schneider Electric Security Notification
Vulnerability Details
CVE ID: CVE-2022-45788
CVSS v3.1 Base Score 7.5 | High | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could
cause arbitrary code execution, denial of service and loss of confidentiality & integrity when amalicious project file is loaded onto the controller.
Note regarding vulnerability details: The severity of vulnerabilities was calculated using the CVSS Basemetrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics.
Schneider Electric recommends that customers score the CVSS Environmental metrics, which are
specific to end-user organizations, and consider factors such as the presence of mitigations in thatenvironment. Environmental metrics may refine the relative severity posed by the vulnerabilities describedin this document within a customer’s environment.

Remediation
Affected Product & Version

Remediation

EcoStruxure™ Control Expert
Versions prior to v15.3

Software v15.3 includes a fix for this vulnerability and isavailable for download here:
https://www.se.com/ww/en/download/document/EcoStr
uxureControlExpert-V15.3/

Modicon M580 (part numbers
BMEP* and BMEH*, excluding
M580 CPU Safety)
Versions prior to SV4.10

Firmware SV4.10 includes a fix for this vulnerability andis available for download here:
https://www.se.com/ww/en/download/document/BMEx5
8x0x0_SV04.10/

Modicon Momentum Unity M1EProcessor (part numbers
171CBU*) Versions prior to VS2.6

Firmware SV2.6 includes a fix for this vulnerability andis available for download here:
https://www.se.com/ww/en/download/document/Momen
tum_FW_update/Firmware SV3.51 includes a fix for this vulnerability andModicon Modicon M340 CPU (partis available for download here:
numbers BMXP34*)
https://www.se.com/ww/en/product-range/1468Versions prior to SV3.51
modicon-m340/#software-and-firmware
Firmware SV1.90 includes a fix for this vulnerability andModicon MC80 CPU (part numbers
is available for download here:
BMKC80*)https://www.se.com/ww/en/download/document/BMKC
Versions prior to SV1.90
80_Firmware_upgrade/
Modicon M580 CPU Safety(BMEP58*S and BMEH58*S)
Versions prior to SV4.21

Firmware SV4.21 includes a fix for this vulnerability andis available for download here:

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 2 of 11

Schneider Electric Security Notification
https://www.se.com/ww/en/product-range/62098modicon-m580-pac-controller/#software-andfirmware
Important: customer needs to use version of
EcoStruxure™ Control Expert v16.0 HF001 minimum toconnect with the latest version of M580 CPU Safety.
The software is available for download here:
https://www.se.com/ww/en/product-range/548ecostruxure-control-expert-unity-pro/#software-andfirmware
Customers should use appropriate patching methodologies when applying these patches totheir systems. We strongly recommend the use of back-ups and evaluating the impact of thesepatches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch.

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 3 of 11

Schneider Electric Security Notification
Mitigations
Affected Product & Version

Mitigations

EcoStruxure™ Control
ExpertVersions prior to v15.3

If customers choose not to apply the remediation, it isrecommended to apply the following mitigations to reduce therisk of the exploit:• Setup a VPN between the Modicon PLC controllers and theengineering workstation containing EcoStruxure™ Control
Expert. Note: this functionality may be provided by an
external IPSEC compatible firewall located close to thecontroller.
• Harden the workstation running EcoStruxure™ Control
Expert.
• It is recommended to enable the file encryption feature for
all new projects.
• Encrypt project files when stored and restrict the access to
only trusted users.
• When exchanging files over the network, use securecommunication protocols.
• Only open project files received from a trusted source, and it
is recommended to share project files only when configured
with the encryption feature described above.
Compute a hash of the project files and regularly check theconsistency of this hash to verify the integrity before usage.

EcoStruxure™ Process
ExpertAll versions

Schneider Electric is establishing a remediation plan for all
future versions of EcoStruxure™ Process Expert that will
include a fix for this vulnerability. We will update this document
when the remediation is available. Until then, customers should
immediately apply the following mitigations to reduce the risk of
exploit:• Setup a VPN between the Modicon PLC controllers and theengineering workstation containing EcoStruxureTM Process
Expert. Note: this functionality may be provided by an
external IPSEC compatible firewall located close to thecontroller.
• Encrypt project files when stored and restrict the access to
only trusted users.
• When exchanging files over the network, use securecommunication protocols.
• Only open project files received from trusted source.
• Compute a hash of the project files and regularly check theconsistency of this hash to verify the integrity before usage.
Harden the workstation running EcoStruxure™ Process Expert.

Modicon Modicon M340
CPU (part numbers
BMXP34*)

If customers choose not to apply the remediation, it isrecommended to apply the following mitigations to reduce therisk of the exploit:

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 4 of 11

Schneider Electric Security Notification
Versions prior to SV3.51

Modicon M580 CPU (partnumbers BMEP* andBMEH*, excluding M580
CPU Safety)
Versions prior to v4.10••

Setup an application password in the project properties
Setup network segmentation and implement a firewall toblock all unauthorized access to port 502/TCP• Configure the Access Control List following therecommendations of the user manuals: “Modicon M340 for
Ethernet Communications Modules and Processors User
Manual” in chapter “Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K
01000/• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup secured
communications”:
https://www.se.com/ww/en/download/document/EIO000000
1999/• Consider use of external firewall devices such as EAGLE4007 from Belden to establish VPN connections for M340 &M580 architectures. For more details refer to the chapter“How to protect M580 and M340 architectures with
EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO000000
1999/
Ensure the M340 CPU is running with the memory protection
activated by configuring the input bit to a physical input, formore details refer to the following guideline “Modicon
Controllers Platform Cyber Security Reference Manual”, “CPUMemory Protection section”: https://www.schneiderelectric.com/en/download/document/EIO0000001999/
If customers choose not to apply the remediation, then theyshould immediately apply the following mitigations to reduce therisk of exploit:• Setup an application password in the project properties• Setup network segmentation and implement a firewall toblock all unauthorized access to port 502/TCP• Configure the Access Control List following therecommendations of the user manuals: “Modicon M580,
Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO000000
1578/• Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup secured
communications”:
https://www.se.com/ww/en/download/document/EIO000000
1999/• use a BMENOC module and follow the instructions
to configure IPSEC feature as described in the

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 5 of 11

Schneider Electric Security Notification
guideline “Modicon M580 - BMENOC03.1 Ethernet
Communications Schneider Electric Security
Notification Module, Installation and Configuration
Guide” in the chapter “Configuring IPSEC
communications”:
https://www.se.com/ww/en/download/document/HRB
62665/
OR• Use a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter“Configuring the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
OR• Consider use of external firewall devices such as EAGLE4007 from Belden to establish VPN connections for M340 &M580 architectures. For more details refer to the chapter“How to protect M580 and M340 architectures with
EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO000000
1999/• Ensure the M580 CPU is running with the memory
protection activated by configuring the input bit to a physicalinput, for more details refer to the following guideline“Modicon Controllers Platform Cyber Security Reference
Manual”, “CPU Memory Protection section”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/
NOTE: The CPU memory protection cannot be configured with
M580 Hot Standby CPUs. In such cases, use IPsec encrypted
communication.
If customers choose not to apply the remediation, then theyshould immediately apply the following mitigations to reduce therisk of exploit:••
Modicon M580 CPU Safety(BMEP58*S and
BMEH58*S)
Versions prior to SV4.21•

Setup an application password in the project properties
Setup network segmentation and implement a firewall toblock all unauthorized access to port 502/TCP• Configure the Access Control List following therecommendations of the user manuals: “Modicon
M580, Hardware, Reference Manual”
https://www.se.com/ww/en/download/document/EIO
0000001578/
Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup secured
communications”:

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 6 of 11

Schneider Electric Security Notification
https://www.se.com/ww/en/download/document/EIO000000
1999/• use a BMENOC module and follow the instructions
to configure IPSEC feature as described in theguideline “Modicon M580 - BMENOC03.1 Ethernet
Communications Schneider Electric Security
Notification Module, Installation and Configuration
Guide” in the chapter “Configuring IPSEC
communications”:
https://www.se.com/ww/en/download/document/HRB
62665/•••

OR
Use a BMENUA0100 module and follow the instructions toconfigure IPSEC feature as described in the chapter“Configuring the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
OR
Consider use of external firewall devices such as EAGLE4007 from Belden to establish VPN connections for M340 &M580 architectures. For more details refer to the chapter“How to protect M580 and M340 architectures with
EAGLE40 using VPN”:
https://www.se.com/ww/en/download/document/EIO000000
1999/
Ensure the M580 CPU is running with the memory
protection activated by configuring the input bit to a physicalinput, for more details refer to the following guideline“Modicon Controllers Platform Cyber Security Reference
Manual”, “CPU Memory Protection section”:
https://www.schneiderelectric.com/en/download/document/EIO0000001999/

NOTE: The CPU memory protection cannot be configured with
M580 Hot Standby CPUs. In such cases, use IPsec encrypted
communication.
• To further reduce the attack surface on Modicon M580 CPU
Safety:• Ensure the CPU is running in Safety mode andmaintenance input is configured to maintain this
Safety mode during operation – refer to the
document Modicon M580 - Safety System Planning
Guide - in the chapter “Operating Mode Transitions”:
https://www.se.com/ww/en/download/document/QG
H60283/
Modicon MOMENTUM
Unity M1E
Processor(171CBU*)

If customers choose not to apply the remediation, then theyshould immediately apply the following mitigations to reduce therisk of exploit:

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 7 of 11

Schneider Electric Security Notification
Versions prior to SV2.6•••

Setup an application password in the project properties
Setup network segmentation and implement a firewall toblock all unauthorized access to port 502/TCP
Configure the Access Control List following therecommendations of the user manuals:• “Momentum for EcoStruxure™ Control Expert – 171
CBU 78090, 171 CBU 98090, 171 CBU 98091
Processors” manual in the chapter “Modbus
Messaging and Access Control”:
https://www.se.com/ww/en/download/document/HRB
44124/

Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup secured
communications”:
https://www.se.com/ww/en/download/document/EIO000000199
9/

Modicon MC80 (BMKC80)
All versions prior to SV1.90

If customers choose not to apply the remediation, it isrecommended to apply the following mitigations to reduce therisk of the exploit:• Setup an application password in the project properties• Setup network segmentation and implement a firewall toblock all unauthorized access to port 502/TCP• Configure the Access Control List following therecommendations of the user manuals:• “Modicon MC80 Programmable Logic Controller(PLC) manual” in the chapter “Access Control List
(ACL)”:
https://www.se.com/ww/en/download/document/EIO
0000002071/
Setup a secure communication according to the following
guideline “Modicon Controllers Platform Cyber Security
Reference Manual,” in chapter “Setup secured
communications”:
https://www.se.com/ww/en/download/document/EIO000000199
9/

Modicon Premium CPU(TSXP5*) & Quantum CPU(140CPU65*)
All versions

Schneider Electric’s Modicon Premium & Quantum controllers
have reached their end of life and are no longer commerciallyavailable. They have been replaced by the Modicon M580
ePAC controller, our most current product offer.
Customers should strongly consider migrating to the Modicon
M580 ePAC. Please contact your local Schneider Electric
technical support for more information.
To mitigate the risks users should immediately:• Setup network segmentation and implement a firewall toblock all unauthorized access to port 502/TCP

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 8 of 11

Schneider Electric Security Notification
Configure the Access Control List following therecommendations of the user manual “Premium and Atrium
using EcoStruxure™ Control Expert – Ethernet Network
Modules, User Manual” in chapters “Connection configuration
parameters / TCP/IP Services Configuration Parameters /Connection Configuration Parameters”:
https://www.se.com/ww/en/download/document/35006192K010
00/

General Security Recommendations
We strongly recommend the following industry cybersecurity best practices.
•
•
•
•
•
•
•
•

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Install physical controls so no unauthorized personnel can access your industrial control
and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the network intended forthat device.
Scan all methods of mobile data exchange with the isolated network such as CDs, USB
drives, etc. before use in the terminals or any node connected to these networks.
Never allow mobile devices that have connected to any other network besides theintended network to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems and ensure thatthey are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs). Recognize that VPNs may have vulnerabilities and should be updated to themost current version available. Also, understand that VPNs are only as secure as theconnected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best
Practices document.

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 9 of 11

Schneider Electric Security Notification
Acknowledgements
Schneider Electric recognizes the following researchers for identifying and helping to coordinate
a response to this vulnerability:
CVE

Researchers

CVE-2022-45788

Jos Wetzels and Daniel dos Santos, Forescout Technologies

For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, contact
your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity
Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will befully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit thecompany’s cybersecurity support portal page:https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
LEGAL DISCLAIMER
THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALSLINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN
OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS,REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN“AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRICDISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED,INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE
IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY
DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING
DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL
DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELYLIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY
RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHTTO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION
About Schneider Electric
Schneider’s purpose is to empower all to make the most of our energy and resources, bridging progress andsustainability for all. We call this Life Is On.
Our mission is to be your digital partner for Sustainability and Efficiency.

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 10 of 11

Schneider Electric Security Notification
We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloudconnecting products, controls, software and services, across the entire lifecycle, enabling integrated company
management, for homes, buildings, data centers, infrastructure and industries.
We are the most local of global companies. We are advocates of open standards and partnership ecosystems thatare passionate about our shared Meaningful Purpose, Inclusive and Empowered values.
www.se.com

Revision Control:
Version 1.0.0
10 January 2023

Original Release

Version 2.0.0
14 March 2023

Remediation for EcoStruxure™ Control Expert,
Modicon M580 CPU, and Momentum Unity M1EProcessor are available for download. Additional
mitigations for Modicon M340 were added.

Version 3.0.0
11 April 2023

Remediation for M340 was added in theremediation section. Qualitative severity rating wascorrected to “high” to reflect the CVSS score.

Version 4.0.0
11 July 2023

Remediation for MC80 is added in the remediation
section.

Version 5.0.0
08 August 2023

All versions of the EcoStruxure™ Process Expert
are impacted by this vulnerability.

Version 6.0.0
13 August 2024

A remediation is available for the Modicon M580
CPU Safety (page 2).

CPCERT

Digitally signed by CPCERT
Date: 2024.08.12 12:25:18 -04'00'

10-Jan-23 (13-Aug-24) Document Reference Number – SEVD-2023-010-05 v6.0.0 Page 11 of 11