Schneider Electric Security Notification
Modicon Controllers
14 May 2019 (9 July 2024)

Overview
Schneider Electric is aware of multiple vulnerabilities in its Modicon Controller products.
The Modicon Programmable Automation controllers are used for complex networked
communication, display and control applications
Failure to apply the mitigations or remediations provided below may risk execution of unsolicitedcommand on the PLC which could result in a loss of availability of the controller
July 2024 Update: Modicon MC80 and Momentum M1E PLCs have been identified as impacted
by the CVE-2018-7855. A mitigation is now available.

Affected Products
•
•
•
•
•
•
•

Modicon M580
Modicon M340
Modicon MC80
Modicon Momentum Unity M1E Processor (part numbers 171CBU*)
Modicon Quantum
Modicon Premium
PLC Simulator for EcoStruxure™ Control Expert

Vulnerabilities Details
CVE ID: CVE-2018-7846
CVSS v3.0 Base Score: 5.3 | (Medium) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-501: Trust Boundary Violation vulnerability on connection to the controller exists which
could cause unauthorized access by conducting a brute force attack on Modbus protocol to thecontroller.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 1 of 23

Schneider Electric Security Notification••

Modicon Premium all versions – See recommendations in the Mitigations section.
Modicon Quantum all versions – See recommendations in the Mitigations section.

CVE ID: CVE-2018-7849
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists which could cause a possible Denial ofService due to improper data integrity check when sending files to the controller over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions – See recommendations in the Mitigations section.
• Modicon Quantum all versions – See recommendations in the Mitigations section.
CVE ID: CVE-2018-7843
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists which could cause denial of service whenreading memory blocks with an invalid data size or with an invalid data offset in the controller
over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.80 – A fix is available for thisvulnerability on Modicon M580 firmware since v2.80, refer to the Remediation Steps& Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions prior to version v3.20 – A fix is available on Modicon
Premium v3.20, please contact your Schneider Electric customer support to get thev3.20 firmware.
Modicon Quantum all versions prior to version v3.60 – A fix is available on Modicon
Quantum v3.60, links to fixed version in the Download links section.
CVE ID: CVE-2018-7848
CVSS v3.0 Base Score: 5.9 | (Medium) | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 2 of 23

Schneider Electric Security Notification
CWE-200: Information Exposure vulnerability exists, which could cause the disclosure of SNMP
information when reading files from the controller over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions – See recommendations in the Mitigations section.
• Modicon Quantum all versions – See recommendations in the Mitigations section.

CVE ID: CVE-2018-7842
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-290: Authentication Bypass by Spoofing vulnerability exists which could cause anelevation of privilege by conducting a brute force attack on Modbus parameters sent to thecontroller.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions – See recommendations in the Mitigations section• Modicon Quantum all versions – See recommendations in the Mitigations section
CVE ID: CVE-2018-7847
CVSS v3.0 Base Score: 9.8 | (Critical) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-284: Improper Access Control vulnerability exists which could cause denial of service or
potential code execution by overwriting configuration settings of the controller over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 3 of 23

Schneider Electric Security Notification••

Modicon Premium all versions – See recommendations in the Mitigations section
Modicon Quantum all versions – See recommendations in the Mitigations section

CVE ID: CVE-2018-7850
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-807: Reliance on Untrusted Inputs in a Security Decision vulnerability exists which could
cause invalid information displayed in Unity Pro software.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions – See recommendations in the Mitigations section• Modicon Quantum all versions – See recommendations in the Mitigations section
CVE ID: CVE-2018-7845
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-125: Out-of-bounds Read vulnerability exists, which could cause the disclosure of
unexpected data from the controller when reading specific memory blocks in the controller over
Modbus.
Impacted versions:• Modicon M580 all versions prior to v2.80 – A fix is available for this vulnerability on
Modicon M580 firmware v2.80, refer to the Remediation Steps & Download Links
section.
• Modicon M340 all versions prior to v3.01 – A fix is available for this vulnerability on
Modicon M340 firmware v3.01, refer to the Remediation Steps & Download Links
section.
• Modicon Premium all versions prior to version v3.20 – A fix is available on Modicon
Premium v3.20, please contact your Schneider Electric customer support to get theV3.20 firmware.
• Modicon Quantum all versions prior to version v3.60 – A fix is available on Modicon
Quantum v3.60, links to fixed version in the Download links section.
CVE ID: CVE-2018-7852
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists which could cause denial of service when an
invalid private command parameter is sent to the controller over Modbus.
14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 4 of 23

Schneider Electric Security Notification
Impacted versions:• Modicon M580 with firmware version prior to v2.80 – A fix is available for thisvulnerability on Modicon M580 firmware v2.80, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.01 – A fix is available for thisvulnerability on Modicon M340 firmware v3.01, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions prior to version v3.20 – A fix is available on Modicon
Premium v3.20; please contact your Schneider Electric customer support to get thev3.20 firmware.
• Modicon Quantum all versions prior to version v3.60 – A fix is available on Modicon
Quantum v3.60, links to fixed version in the Download links section.

CVE ID: CVE-2018-7853
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists, which could cause denial of service whenreading invalid physical memory blocks in the controller over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
CVE ID: CVE-2018-7854
Base Score: 7.5 | (High)| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248 Uncaught Exception vulnerability exists which could cause a denial of Service whensending invalid debug parameters to the controller over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
CVE ID: CVE-2018-7855
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248 Uncaught Exception vulnerability exists, which could cause a Denial of Service whensending invalid breakpoint parameters to the controller over Modbus.

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 5 of 23

Schneider Electric Security Notification
Impacted versions:• Modicon Premium all versions – See recommendations in the Mitigations section• Modicon Quantum all versions – See recommendations in the Mitigations section••

Modicon M580 firmware version prior to v4.20 – A fix is available for thisvulnerability on Modicon M580 firmware v4.20, refer to the Remediation Steps &Download Links section.
Modicon M340 firmware version prior to v3.60 – A fix is available for this vulnerability
on Modicon M340 firmware v3.60, refer to the Remediation Steps & Download Links
section.

July 2024 Update:• Modicon MC80 all versions – See recommendations in the Mitigation section• Modicon Momentum M1E all versions – See recommendations in the Mitigations
sectionCVE ID: CVE-2018-7856
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists which could cause a possible denial ofService when writing invalid memory blocks to the controller over Modbus.
Impacted versions:• Modicon M580 all versions prior to v2.80 – A fix is available for this vulnerability on
Modicon M580 firmware v2.80, refer to the Remediation Steps & Download Links
section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions prior to version v3.20 – A fix is available on Modicon
Premium v3.20; please contact your Schneider Electric customer support to get theV3.20 firmware.
Modicon Quantum all versions prior to version v3.60 – A fix is available on Modicon
Quantum v3.60, links to fixed version in the Download links section.
CVE ID: CVE-2018-7857
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists, which could cause a possible Denial ofService when writing out of bounds variables to the controller over Modbus.
Impacted versions:14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 6 of 23

Schneider Electric Security Notification
•

•

•
•
•
•
•
•

Modicon M580 all versions – A partial fix is available for this vulnerability on Modicon
M580 firmware v2.90 or higher.
o Fixes for additional attack scenarios are available in v3.10, refer to theRemediation Steps & Download Links section. Users are also encouraged toapply the additional recommendations proposed in the Mitigations section.
Modicon M340 all versions – A partial fix is available for this vulnerability on Modicon
M340 firmware v3.10 or higher.
o Fixes for additional attack scenarios are available in v3.30, refer to theRemediation Steps & Download Links section. Users are also encouraged toapply the additional recommendations proposed in the Mitigations section.
Modicon Premium all versions – See recommendations in the Mitigations section
Modicon Quantum all versions – See recommendations in the Mitigations section
Modicon MC80 firmware version prior to v1.80 – A fix is available for this vulnerability
on Modicon MC80 (part numbers BMKC80*), refer to the Remediation Steps &Download Links section.
Modicon Momentum CPU (part numbers 171CBU*) all versions – Seerecommendations in the Mitigations section
PLC Simulator for EcoStruxure™ Control Expert prior to v15.1 – A fix is available forthis vulnerability on PLC Simulator, refer to the Remediation Steps & Download Links
section.
Modicon Momentum Unity M1E Processor (part numbers 171CBU*) versions prior
to sv2.6 – A fix is available for this vulnerability on Modicon Momentum CPU, refer tothe Remediation Steps & Download Links section.

CVE ID: CVE-2019-6806
CVSS v3.0 Base Score: 7.5 | (High)| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200: Information Exposure vulnerability exists which could cause the disclosure of SNMP
information when reading variables in the controller using Modbus.
Impacted versions:• Modicon M580 all firmware versions – See recommendations in the Mitigations
section• Modicon M340 all firmware versions – See recommendations in the Mitigations
section• Modicon Premium all versions – See recommendations in the Mitigations section• Modicon Quantum all versions – See recommendations in the Mitigations section
CVE ID: CVE-2019-6807
CVSS v3.0 Base Score: 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists which could cause a possible denial ofservice when writing sensitive application variables to the controller over Modbus.

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 7 of 23

Schneider Electric Security Notification
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions prior to version v3.20 – A fix is available on Modicon
Premium v3.20, please contact your Schneider Electric customer support to get thev3.20 firmware.
• Modicon Quantum all versions prior to version v3.60 – A fix is available on Modicon
Quantum v3.60, links to fixed version in the Download links section.
• Modicon MC80 with firmware version prior to v1.80 – A fix is available for thisvulnerability on Modicon MC80 (part numbers BMKC80*), refer to the Remediation
Steps & Download Links section.
• Modicon Momentum CPU (part numbers 171CBU*) all versions – Seerecommendations in the Mitigations section• PLC Simulator for EcoStruxure™ Control Expert prior to v15.1 – A fix is available forthis vulnerability on PLC Simulator, refer to the Remediation Steps & Download Links
section.
• Modicon Momentum Unity M1E Processor (part numbers 171CBU*) versions prior
to sv2.6 – A fix is available for this vulnerability on Modicon Momentum CPU, refer tothe Remediation Steps & Download Links section.
CVE ID: CVE-2019-6808
CVSS v3.0 Base Score: 10.0 | (Critical) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-284: Improper Access Control vulnerability exists, which could cause a remote code
execution by overwriting configuration settings of the controller over Modbus.
Impacted versions:• Modicon M580 firmware version prior to v2.90 – A fix is available for thisvulnerability on Modicon M580 firmware v2.90, refer to the Remediation Steps &Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions –see recommendations in the Mitigations
section.
• Modicon Quantum all versions –see recommendations in the Mitigations section.
CVE ID: CVE-2018-7844
CVSS v3.0 Base Score: 7.5 | (High)| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-200: Information Exposure vulnerability exists, which could cause the disclosure of SNMP
information when reading memory blocks from the controller over Modbus.
14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 8 of 23

Schneider Electric Security Notification
Impacted versions:• Modicon M580 all versions – See recommendations in the Mitigations section.
• Modicon M340 all versions – See recommendations in the Mitigations section.
• Modicon Premium all versions – See recommendations in the Mitigations section.
• Modicon Quantum all versions – See recommendations in the Mitigations section.

CVE ID: CVE-2019-6830
CVSS v3.0 Base Score: 5.9 | (Medium)| CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists, which could cause a possible denial ofservice when sending an appropriately timed HTTP request to the controller.
Impacted versions:• Modicon M580 all versions prior to v2.80 – A fix is available for this vulnerability on
Modicon M580 firmware v2.80, refer to the Remediation Steps & Download Links
section.
CVE ID: CVE-2019-6828
CVSS v3.0 Base Score: 7.5 | (High)| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists, which could cause a possible denial ofservice when reading specific coils and registers in the controller over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available
for this vulnerability on Modicon M580 firmware v2.90, refer to theRemediation Steps & Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available
for this vulnerability on Modicon M340 firmware v3.10, refer to theRemediation Steps & Download Links section.
• Modicon Premium all versions prior to version v3.20 – A fix is available on
Modicon Premium v3.20, please contact your Schneider Electric customer
support to get the v3.20 firmware.
• Modicon Quantum all versions prior to version v3.60 – A fix is available on
Modicon Quantum v3.60, links to fixed version in the Download links section.
CVE ID: CVE-2019-6829
CVSS v3.0 Base Score: 7.5 | (High)| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists which could cause a possible denial ofservice when writing to specific memory addresses in the controller over Modbus.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available
for this vulnerability on Modicon M580 firmware v2.90, refer to the

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 9 of 23

Schneider Electric Security Notification
Remediation Steps & Download Links section.
Modicon M340 with firmware version prior to v3.10 – A fix is available
for this vulnerability on Modicon M340 firmware v3.10, refer to theRemediation Steps & Download Links section.

•

CVE ID: CVE-2019-6809
CVSS v3.0 Base Score: 7.5 | (High)| CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-248: Uncaught Exception vulnerability exists, which could cause a possible denial ofservice when reading invalid data from the controller.
Impacted versions:• Modicon M580 with firmware version prior to v2.90 – A fix is available
for this vulnerability on Modicon M580 firmware v2.90, refer to theRemediation Steps & Download Links section.
• Modicon M340 with firmware version prior to v3.10 – A fix is available for thisvulnerability on Modicon M340 firmware v3.10, refer to the Remediation Steps &Download Links section.
• Modicon Premium all versions prior to version v3.20 – A fix is available on
Modicon Premium v3.20; please contact your Schneider Electric customer
support to get the v3.20 firmware.
• Modicon Quantum all versions prior to version v3.60 – A fix is available on
Modicon Quantum v3.60, links to fixed version in the Download links section.

Mitigations
The vulnerabilities described in this document are linked to weaknesses in the management of
Modbus protocol. Customers using products with no fix available are strongly recommended to
implement the mitigations listed below to reduce risk.
Modicon M580:
It is recommended to apply the following mitigations to reduce the risk of the exploit:
•
•
•

•

Setup an application password in the project properties
Setup network segmentation and implement a firewall to block all unauthorizedaccess to port 502/TCP
Configure the Access Control List following the recommendations of the user
manuals:o “Modicon M580, Hardware, Reference Manual”:
https://www.se.com/ww/en/download/document/EIO0000001578/
Setup a secure communication according to the following guideline “Modicon
Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://www.se.com/ww/en/download/document/EIO0000001999/

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 10 of 23

Schneider Electric Security Notificationouse a BMENOC module and follow the instructions to configure IPSEC
feature as described in the guideline “Modicon M580 - BMENOC03.1
Ethernet Communications Schneider Electric Security Notification Module,
Installation and Configuration Guide” in the chapter “Configuring IPSEC
communications”:
https://www.se.com/ww/en/download/document/HRB62665/

OR•

Use a BMENUA0100 module and follow the instructions to configure IPSEC feature
as described in the chapter “Configuring the BMENUA0100 Cybersecurity Settings”:
https://www.se.com/ww/en/download/document/PHA83350
OR

•

•

Consider use of external firewall devices such as EAGLE40-07 from Belden to
establish VPN connections for M340 and M580 architectures. For more details referto the chapter “How to protect M580 and M340 architectures with EAGLE40 using
VPN”: https://www.se.com/ww/en/download/document/EIO0000001999/
Ensure the M580 CPU is running with the memory protection activated byconfiguring the input bit to a physical input, for more details refer to the following
guideline “Modicon Controllers Platform Cyber Security Reference Manual”, “CPUMemory Protection section”:
https://www.schneider-electric.com/en/download/document/EIO0000001999/
o NOTE: The CPU memory protection cannot be configured with M580 Hot
Standby CPUs. In such cases, use IPsec encrypted communication.

Modicon M340:
It is recommended to apply the following mitigations to reduce the risk of the exploit:
•
•
•

•

•

Setup an application password in the project properties
Setup network segmentation and implement a firewall to block all unauthorizedaccess to port 502/TCP
Configure the Access Control List following the recommendations of the user
manuals:o “Modicon M340 for Ethernet Communications Modules and Processors User
Manual” in chapter “Messaging Configuration Parameters”:
https://www.se.com/ww/en/download/document/31007131K01000/
Setup a secure communication according to the following guideline “Modicon
Controllers Platform Cyber Security Reference Manual,” in chapter “Setup secured
communications”: https://www.se.com/ww/en/download/document/EIO0000001999/
Consider use of external firewall devices such as EAGLE40-07 from Belden to
establish VPN connections for M340 & M580 architectures. For more details refer to

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 11 of 23

Schneider Electric Security Notification
the chapter “How to protect M580 and M340 architectures with EAGLE40 using
VPN”: https://www.se.com/ww/en/download/document/EIO0000001999/

Modicon Momentum:
To mitigate the risks associated to Modbus weaknesses, users should immediately:
•
•
•

•

•

Setup an application password in the project properties
Setup network segmentation and implement a firewall to block all unauthorizedaccess to port 502/TCP
Configure the Access Control List following the recommendations of the user
manuals:o “Momentum for EcoStruxure™ Control Expert - 171 CBU 78090, 171 CBU
98090, 171 CBU 98091 Processors” manual in the chapter “Modbus
Messaging and Access Control” https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=HRB44124.08.p
df&p_Doc_Ref=HRB44124
Setup a secure communication according to the following guideline “Modicon
Controller Systems Cybersecurity, User Guide” in chapter “Set Up Encrypted
Communication”: https://www.se.com/ww/en/download/document/EIO0000001999/
Setup a VPN between the Modicon PLC controllers and the engineering workstation
containing EcoStruxure Control Expert or Process Expert. Note: this functionality
may be provided by an external IPSEC compatible firewall located close to thecontroller.

Modicon Premium:
Schneider Electric’s Modicon Premium controllers have reached their end of life and are nolonger commercially available. They have been replaced by the Modicon M580 ePAC controller,
our most current product offer. Customers should strongly consider migrating to the Modicon
M580 ePAC. Please contact your local Schneider Electric technical support for more
information.
To mitigate the risks associated to Modbus/ weaknesses, users should immediately:••

Setup network segmentation and implement a firewall to block all unauthorizedaccess to port 502/TCP
Configure the Access Control List following the recommendations of the user manual“Premium and Atrium using EcoStruxure™ Control Expert - Ethernet Network
Modules, User Manual” in chapters “Connection configuration parameters / TCP/IP
Services Configuration Parameters / Connection Configuration Parameters”:
https://www.se.com/ww/en/download/document/35006192K01000/

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 12 of 23

Schneider Electric Security Notification
Modicon Quantum:
Schneider Electric’s Modicon Quantum controllers have reached their end of life and are nolonger commercially available. They have been replaced by the Modicon M580 ePAC controller,
our most current product offer. Customers should strongly consider migrating to the Modicon
M580 ePAC. Please contact your local Schneider Electric technical support for more
information.
To mitigate the risks associated to Modbus/ weaknesses, users should immediately:••

Setup network segmentation and implement a firewall to block all unauthorizedaccess to port 502/TCP
Configure the Access Control List feature as mentioned in “Quantum using
EcoStruxure™ Control Expert - TCP/IP Configuration, User Manual” in chapter“Software Settings for Ethernet Communication / Messaging / Quantum NOE
Ethernet Messaging Configuration”:
https://www.se.com/ww/en/download/document/33002467K01000/

Modicon MC80:
To mitigate the risks associated with CVE-2018-7855, users should immediately apply thefollowing steps:
•
•
•
•
•

Setup an application password in the project properties
Setup network segmentation and implement a firewall to block all unauthorized accessto port 502/TCP
Configure the Access Control List following the recommendations of the user manuals:“Modicon MC80 Programmable Logic Controller (PLC) manual” in the chapter “AccessControl List (ACL)”: https://www.se.com/ww/en/download/document/EIO0000002071/
Setup a secure communication according to the following guideline “Modicon Controller
Systems Cybersecurity, User Guide” in chapter “Set Up Encrypted Communication”:
https://www.se.com/ww/en/download/document/EIO0000001999/

PLC Simulator for EcoStruxure™ Control Expert
Customers should immediately apply the following mitigations to reduce the risk of exploit:•••

On the engineering workstation, update to EcoStruxure Control Expert v15.1 or later(https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unitypro/#software-and-firmware).
Ensure to use simulator default panel option to make PLC simulator accessible only
locally.
Modbus network connections are disabled by default on the PLC Simulator present in
EcoStruxure™ Control Expert, mitigating the risk associated to this vulnerability.

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 13 of 23

Schneider Electric Security Notification
Note: The PLC Simulator feature is part of the EcoStruxure Control Expert software, and it helps
users to review and test their configurations files in a simulation environment. It is not intended
to be used as a controller CPU in a production environment.

Remediation Steps & Download Links
M580 Remediation Steps
Schneider Electric has made a fix available via a free download. After downloading the fix, foundin the below, all of the following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware.
••On the engineering workstation, update to EcoStruxure Control Expert
v16.0(https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unitypro/-software-and-firmare).
On the Modicon M580 controller, update to firmware SV4.20 or above, download link
available below.

STEP 2: Update projects in Ecostruxure Control Expert by:••

Setting up an application password in the project properties
Changing the version of the controller firmware to match the new firmware version of
the target controller

STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:••

Rebuild all current projects
Transfer them to Modicon controllers

M580 sv4.20 Firmware
Modicon M580 (partnumbers
BMEP* and BMEH*,
excluding
M580 CPU Safety)
Versions prior to
sv4.20https://www.se.com/ww/en/product-range/62098-modicon-m580epac/#software-and-firmware

M340 Remediation Steps
Schneider Electric has made a fix available via a free download. After downloading the fix, foundbelow, all of the following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 14 of 23

Schneider Electric Security Notification••

On the engineering workstation, update to EcoStruxure Control Expert v16.0 or later(https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unitypro/#software-and-firmware).
On the Modicon M340 controller, update to firmware v3.60 or above, download link
available below.

STEP 2: Update projects in Ecostruxure Control Expert by:••

Setting up an application password in the project properties
Changing the version of the controller firmware to match the new firmware version of
the target controller

STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:••

Rebuild all current projects
Transfer them to Modicon controllers

M340 SV3.60 Firmware
Modicon M340 CPU(part numbers
BMXP34*)
Versions prior to sv3.60

https://www.se.com/ww/en/product-range/1468- modiconm340/#software-and-firmware

Modicon MC80 Remediation Steps
Schneider Electric has made a fix available via a free download. After downloading the fix, foundbelow, all of the following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware.
••On the engineering workstation, update to EcoStruxure Control Expert V15.1 or later(https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unitypro/#software-and-firmware).
On the Modicon MC80 controller, update to firmware V1.80 or above, download link
available below.

STEP 2: Update projects in Ecostruxure Control Expert by:••

Setting up an application password in the project properties
Changing the version of the controller firmware to match the new firmware version of
the target controller

STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:••

Rebuild all current projects
Transfer them to Modicon controllers

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 15 of 23

Schneider Electric Security Notification
MC80 v1.80 Firmware
BMKC8020301

https://www.se.com/ww/en/product-range/62396-modicon-mc80/#softwareand-firmware

Modicon Momentum Unity M1E Processor (part numbers 171CBU*) Remediation Steps
Schneider Electric has made a fix available via a free download. After downloading the fix, foundbelow, all of the following steps are required to remediate the vulnerability:
STEP 1: Update software and firmware.
••On the engineering workstation, update to EcoStruxure Control Expert v15.1 or later(https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unitypro/#software-and-firmware).
On the Modicon Momentum CPU, update to firmware v2.6, download link available
below.

STEP 2: Update projects in Ecostruxure Control Expert by:••

Setting up an application password in the project properties
Changing the version of the controller firmware to match the new firmware version of
the target controller

STEP 3: Rebuild and transfer projects in EcoStruxure Control Expert:••

Rebuild all current projects
Transfer them to Modicon controllers

Modicon Momentum CPU sv2.6 Firmware
171CBU98090

https://www.se.com/ww/en/download/document/Momentum_FW_update/

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 16 of 23

Schneider Electric Security Notification
Premium v3.20 firmware
Premium v3.20 firmware
TSXP57104M [C]TSXP57154M [C]TSXP571634M [C]TSXP57204M [C]TSXP572634M [C]TSXP57254M [C]TSXP57304M [C]TSXP573634M [C]TSXP57354M [C]TSXP574634M [C]TSXP57454M [C]TSXP575634M [C]TSXP57554M [C]TSXP576634M [C]TSXH5724M [C]TSXH5744M [C]Please contact your Schneider Electric customer support to get
Premium V3.20 firmware.

Quantum v3.60 firmware
Quantum v3.60 firmware
140CPU65150 [C]
140CPU65160 [C]

https://www.schneiderelectric.com/en/download/document/Quantum_140CPU651X0_SV3.60

140CPU65260 [C]

https://www.schneiderelectric.com/en/download/document/Quantum_140CPU65260_SV3.60

140CPU67261 [C]https://www.schneiderelectric.com/en/download/document/Quantum_140CPU67261_SV3.60

140CPU67060 [C]

https://www.schneiderelectric.com/en/download/document/Quantum_140CPU67060_SV3.60

140CPU67160 [C]

https://www.schneiderelectric.com/en/download/document/Quantum_140CPU67160_SV3.60

140CPU67261 [C]https://www.schneiderelectric.com/en/download/document/Quantum_140CPU67261_SV3.60

140CPU67260 [C]

https://www.schneiderelectric.com/en/download/document/Quantum_140CPU67260_SV3.60

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 17 of 23

Schneider Electric Security Notification
140CPU65860 [C]

https://www.schneiderelectric.com/en/download/document/Quantum_140CPU65860_SV3.60

140CPU67861 [C]https://www.schneiderelectric.com/en/download/document/Quantum_140CPU67861_SV3.60

140CPU65160S

Please contact your Schneider Electric customer support to get Quantum
V3.60 firmware as this product is end of life.

140CPU67160S

Please contact your Schneider Electric customer support to get Quantum
V3.60 firmware

PLC Simulator for EcoStruxure™ Control Expert
Schneider Electric has made a fix available via a free download.
EcoStruxure™ Control Expert v15.1
https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/#softwareand-firmware)

Product Information
Ethernet Programmable Automation Controller for industrial process and infrastructure
Product Category - All Categories
Learn more about Schneider Electric’s product categories here: www.schneider-electric.us/en/all-products

How to determine if you are affected
Affected products listed in this security notification connected to an Ethernet network.

General Security Recommendations
We strongly recommend the following industry cybersecurity best practices:••

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Install physical controls so no unauthorized personnel can access your industrial control
and safety systems, components, peripheral equipment, and networks.

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 18 of 23

Schneider Electric Security Notification
•
•
•
•
•
•

Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the network for thedevices that it is intended.
Scan all methods of mobile data exchange with the isolated network such as CDs, USB
drives, etc. before use in the terminals or any node connected to these networks.
Never allow laptops that have connected to any other network besides the intended
network to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems, and ensure thatthey are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs). Recognize that VPNs may have vulnerabilities and should be updated to themost current version available. Also, understand that VPNs are only as secure as theconnected devices.

Acknowledgements
Schneider Electric recognizes the following researchers for identifying and helping to coordinate a
response to these vulnerabilities:
CVE

Researchers Name

CVE-2018-7843, CVE-2018-7844, CVE-2018-7845, CVE2018-7850, CVE-2018-7852, CVE-2018-7853, CVE-20187854, CVE-2018-7855, CVE-2018-7856, CVE-2019-6806,
CVE-2019-6807, CVE-2019-6808, CVE-2019-6809, CVE2019-6828, CVE-2019-6829, CVE-2019-6830

Jared Rittle (Cisco Talos)
Gao Jian (ns focus)

Jared Rittle (Cisco Talos)
CVE-2018-7842, CVE-2018-7846, CVE-2018-7847, CVE2018-7848, CVE-2018-7849

CVE-2018-7857

Pavel Nesterov and Artem
Zinenko from Kaspersky ICS
CERT
Jared Rittle (Cisco Talos)
Dong Yang (Dingxiang
Dongjian Security Lab)
Gao Jian (ns focus)

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 19 of 23

Schneider Electric Security Notification
For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, pleasecontact your local Schneider Electric representative and Schneider Electric Industrial
Cybersecurity Services. These organizations will be fully aware of this situation and can support
you through the process.
https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp
https://www.se.com/ww/en/work/services/field-services/industrial-automation/industrialcybersecurity/industrial-cybersecurity.jsp
Legal Disclaimer
THIS DOCUMENT IS INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND
SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY
RECOMMENDATIONS AND IS PROVIDED ON AN “AS-IS” BASIS WITHOUT WARRANTY OF ANY KIND.
SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDINGWARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALLSCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT,INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IFSCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. THE USE OF THISNOTIFICATION, INFORMATION CONTAINED HEREIN, OR MATERIALS LINKED TO IT ARE AT YOUR OWN
RISK. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY
TIME AND IN ITS SOLE DISCRETION.
About Schneider Electric
Schneider’s purpose is to create Impact by empowering all to make the most of our energy and resources,
bridging progress and sustainability for all. We call this Life Is On.
Our mission is to be the trusted partner in Sustainability and Efficiency.
We are a global industrial technology leader bringing world-leading expertise in electrification, automation anddigitization to smart industries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive
homes. Anchored by our deep domain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT
solutions with connected products, automation, software and services, delivering digital twins to enable profitable
growth for our customers.
We are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating inover 100 countries to ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in
everything we do, guided by our meaningful purpose of a sustainable future for all.
www.se.com

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 20 of 23

Schneider Electric Security Notification
Revision Control:
Version 1.0.0
14 May 2019

Original Release

Version 1.1.0
09 Jul 2019

Updated to include links to M580 V2.90 Firmware and Control Expert Hot Fix
v14.0

Version 1.2.0
12 Jul 2019

Updated mitigations for CVE-2019-6808

Version 1.3.0
24 Jul 2019

Updated links to M580 v2.90 Firmware

Version 2.0.0
13 Aug 2019

Updated:• CVE-2018-7846: added fix available for M340 v3.10• CVE-2018-7849: added fix available for M340 v3.10• CVE-2018-7848: added fix available for M340 v3.10• CVE-2018-7842: added fix available for M340 v3.10• CVE-2018-7847: added fix available for M340 v3.10• CVE-2018-7850: added fix available for M340 v3.10• CVE-2018-7854: added fix available for M340 v3.10• CVE-2018-7852: modified to change M580 release which waserroneous (2.80 instead of 2.90)• CVE-2018-7855: added fix available for M340 v3.10• CVE-2019-6807: added fix available for M340 v3.10• CVE-2019-6808: added fix available for M340 V3.10• CVE-2018-7843: modified to change M340 release which waserroneous (3.01 instead of 3.10)• CVE-2018-7856: added fix on M340 v3.10 (available earlier than
expected)
Added 4 new CVEs:• CVE-2019-6830• CVE-2019-6828• CVE-2019-6829• CVE-2019-6809

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 21 of 23

Schneider Electric Security Notification

Version 3.0.0
10 Dec 2019

Updated:• CVE-2019-6806: Corrected remediation information for Modicon
M340• CVE-2018-7845: Fix for Premium & Quantum• CVE-2018-7843: Fix for Premium & Quantum• CVE-2019-6809: Fix for Premium & Quantum• CVE-2019-6807: Fix for Premium & Quantum• CVE-2018-7857: Fix for Premium & Quantum• CVE-2018-7856: Fix for Premium & Quantum• CVE-2018-7852: Fix for Premium & Quantum• CVE-2019-6828: Fix for Premium & Quantum• Update of download links for latest versions of M580 / M340 &Quantum, plus customer support information for Premium.

Version 4.0.0
12 May 2020

Updated fix version information for CVE-2018-7857

Version 4.1.0
11 August 2020

Updated fix version information for CVE-2018-7857:• Additional fixes available for M580 v3.10• Quantum & Premium previous fix is not enough to correct the
CVE and requires the additional mitigations proposed
Additional required remediation steps added for M580 and M340 applicableto the following CVEs:

Version 5.0.0
12 October 2020

•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•

•

CVE-2018-7846
CVE-2018-7849
CVE-2018-7843
CVE-2018-7848
CVE-2018-7842
CVE-2018-7847
CVE-2018-7850
CVE-2018-7845
CVE-2018-7852
CVE-2018-7853
CVE-2018-7854
CVE-2018-7855
CVE-2018-7856
CVE-2018-7857
CVE-2019-6807
CVE-2019-6808
CVE-2019-6830
CVE-2019-6828
CVE-2019-6829
CVE-2019-6809

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 22 of 23

Schneider Electric Security Notification
Version 6.0.0
08 December 2020

A fix for additional attack scenario is available on M340 v3.30 for
CVE-2018-7857.

Version 7.0.0
13 September 2022

Modicon MC80 and PLC Simulator for EcoStruxure™ Control Expert wereadded as impacted product of CVE-2018-7857 and CVE-2019-6807 and theremediation is provided.

Version 8.0.0
10 January 2023

Modicon M340 and M580 latest firmware versions are affected by CVE2018-7855 and additional mitigations were added in the mitigation section.

Version 9.0.0
14 March 2023

A remediation is available for Modicon Momentum Unity M1E Processor partnumbers 171CBU* for CVE-2018-7857 and CVE-2019-6807

Version 10.0.0
13 February 2024

A remediation is available for Modicon M340 and M580 for CVE-2018-7855.
Updated products affected version numbers.

Version 11.0.0
09 July 2024

Modicon MC80 and Momentum M1E PLCs were added as impacted
products of CVE-2018-7855. Mitigations are available for Modicon MC80 andMomentum M1E PLCs for CVE-2018-7855.

CPCERT

Digitally signed by CPCERT
Date: 2024.07.08 13:03:58 -04'00'

14-May-19 (09-Jul-24) Document Reference Number – SEVD-2019-134-11 (v11.0.0) Page 23 of 23