Schneider Electric Security Notification
CODESYS Runtime Vulnerabilities
11 July 2023 (11 June 2024)

Overview
Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS runtime system
V3 communication server. Many vendors, including Schneider Electric, embed CODESYS in
their offers.
If successfully exploited, these vulnerabilities could result in a denial of service or, in somecases, in remote code execution on PacDrive controllers, Modicon Controllers M241 / M251 /M262 / M258 / LMC058 / LMC078 / M218, HMISCU, and the Simulation Runtime SoftSPS &Vijeo Designer embedded in EcoStruxure Machine Expert products, Harmony
HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series, iPC series, Easy Harmony
HMIET6/HMIFT6, and Magelis HMIGXU, XBT series, Easy Modicon M310.
Failure to apply the mitigations provided below may result in denial of service and/or arbitrary
remote code execution.
June 2024 Update: Easy Modicon M310 is added to the list of products impacted.

Details
Vulnerabilities disclosed by CODESYS™ group in the CODESYS Runtime and Simulation
Runtime impact Schneider Electric controller products and software.
Additional information about the vulnerabilities can be found in the CODESYSTM Advisories at:
•
•
•
•
•
•
•
•

Advisory 2023-02
Advisory 2023-03
Advisory 2023-04
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 1 of 10

Schneider Electric Security Notification
Affected Products and Versions
Product

VersionEasy Harmony HMIET6/HMIFT6
Magelis HMIGXU, XBT series

All versions

Easy Modicon M310

All versions

Harmony (Formerly Magelis)
All versions prior to V6.3 HF3HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series,
Harmony
iPC series with Vijeo Designer runtime

All versions

HMISCU Controller

All versions prior to v6.3.1

Modicon Controller LMC078

All versions

Modicon Controller M241

All versions prior to v5.2.11.18

Modicon Controller M251

All versions prior to v5.2.11.18

Modicon Controller M262

All versions prior to v5.2.8.12

Modicon Controller M258

All versions

Modicon Controller LMC058

All versions

Modicon Controller M218

All versions

PacDrive 3 Controllers: LMC Eco/Pro/Pro2

All versions prior to v1.76.14.1

SoftSPS embedded in EcoStruxure™ Machine Expert

All versions prior to Machine Expert
v2.2

Vijeo Designer embedded in EcoStruxure™ Machine
ExpertAll versions prior to v6.3.1

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 2 of 10

Schneider Electric Security Notification
Remediation
Affected Product& Version

Remediation

Vijeo Designer Basic v2.0 HotFix 2 includes a fix for
this vulnerability. Please contact your Schneider
Easy Harmony
HMIET6/HMIFT6 Electric Customer Care Center to obtain the
installer.
MagelisHMIGXUAll versions prior To complete the update, connect to Harmony HMI
to v2.0 HF2and download the firmware using Vijeo Designer
Basic.
Version 6.3 HF3 of Vijeo Designer includes a fix for
this vulnerability and can be updated through theHarmony
Schneider Electric Software Update (SESU)(Formerly
application.
Magelis)HMIGK/HMIGTAs an alternative, please contact your Schneider
O/HMIGTU/HMIElectric Customer Care Center to obtain the Hot
GTUX/HMISTU
Fix. For additional details, please refer to theseriessupplied help file in Hot Fix.
All versions prior
to v6.3 HF3On the engineering workstation, update to v6.3 HF3of Vijeo Designer.
Version 6.3.1 of Vijeo Designer includes a fix for
this vulnerability and can be updated through the
Schneider Electric Software Update (SESU)
application.
HMISCU
Controller
All versions prior
to v6.3.1

https://www.se.com/ww/en/product-range/1054vijeo-designer-hmi-software/#software-andfirmware

RemediatedAdvisory
Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09
Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

On the engineering workstation, update to v6.3.1ofVijeo Designer.

Magelis XBT
seriesAll versions

To complete the update, connect to Harmony HMI
and download the project file using Vijeo Designerv6.3.1.
Schneider Electric’s Magelis XBT series havereached their end of commercialization. Magelis
XBTGT/XBTGK offers have been replaced by
HMIGTO/HMIGTU/HMIGK. We recommend ourcustomers to migrate to the latest offers. For
Magelis XBT series that haven't been replaced,
please contact your local Schneider Electric
technical support for more information.

Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 3 of 10

Schneider Electric Security Notification

ModiconController
LMC078All versions

Schneider Electric’s Modicon LMC078 controllers
have reached end of their life and are no longer
commercially available. They have been replacedby the Modicon M262 controllers. We recommend
our customers to migrate to the latest offer. Pleasecontact your local Schneider Electric technicalsupport for more information.

Schneider Electric’s Modicon M218 controllers
have reached their end of life and are no longer
commercially available. They have been replaced
Modiconby the Modicon Easy M200 and Modicon M241
Controller M218
controllers. We recommend our customers to
All versions
migrate to the latest offer. Please contact your local
Schneider Electric technical support for more
information.
Modicon Controller M241 Firmware delivered with
Machine Expert v2.2 includes a fix for thisvulnerability and can be updated through the
Schneider Electric Software Update (SESU)
Modiconapplication.
Controller M241
All versions priorhttps://www.se.com/ww/en/product-range/2226toecostruxure-machine-expert-software/
V5.2.11.18

Advisory 2023-02
Advisory 2023-03
Advisory 2023-04
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09
Advisory 2023-02
Advisory 2023-03
Advisory 2023-04
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09
Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

On the engineering workstation, update to v2.2 ofMachine Expert.
Update Modicon Controller M241 to the latest
Firmware and preform reboot.
Modicon Controller M251 Firmware delivered with
Machine Expert v2.2 includes a fix for thisvulnerability and can be updated through the
ModiconSchneider Electric Software Update (SESU)
Controller M251 application.
All versions priortohttps://www.se.com/ww/en/product-range/2226v5.2.11.18
ecostruxure-machine-expert-software/

Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

On the engineering workstation, update to v2.2 ofMachine Expert.
Update Modicon Controller M251 to the latest
Firmware and preform reboot.
Modicon
Modicon Controller M262 Firmware delivered with
Controller M262 Machine Expert v2.2 includes a fix for thisAll versions prior vulnerability and can be updated through thetoSchneider Electric Software Update (SESU)
v5.2.8.12
application.

Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 4 of 10

Schneider Electric Security Notification
https://www.se.com/ww/en/product-range/2226ecostruxure-machine-expert-software/

Advisory 2023-08
Advisory 2023-09

On the engineering workstation, update to v2.2 ofMachine Expert.
Update Modicon Controller M262 to the latest
Firmware and preform reboot.
PacDrive 3 Controllers LMC Eco/Pro/Pro2
Firmware delivered with Machine Expert V2.2
includes a fix for this vulnerability and can be
updated through the Schneider Electric Software
Update (SESU) application.

PacDrive 3
Controller: LMC
Eco/Pro/Pro2
https://www.se.com/ww/en/product-range/2226All versions priorecostruxure-machine-expert-software/tov1.76.14.1
On the engineering workstation, update to V2.2 ofMachine Expert.

SoftSPS
embedded in
EcoStruxure™
Machine Expert
All versions prior
to v2.2

Vijeo Designer
embedded in
EcoStruxure™
Machine Expert
All versions prior
to v6.3.1

Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2
to the latest Firmware and preform reboot.
SoftSPS component has been removed from
Machine Expert V2.2. Machine Expert can be
updated through the Schneider Electric Software
Update (SESU) application.
https://www.se.com/ww/en/product-range/2226ecostruxure-machine-expert-software/
Version 6.3.1 of Vijeo Designer includes a fix for
this vulnerability and can be updated through the
Schneider Electric Software Update (SESU)
application.
https://www.se.com/ww/en/product-range/1054vijeo-designer-hmi-software/#software-andfirmware

Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09
Advisory 2023-02
Advisory 2023-03
Advisory 2023-05
Advisory 2023-06
Advisory 2023-07
Advisory 2023-08
Advisory 2023-09

On the engineering workstation, update to v6.3.1ofVijeo Designer.
Customers should use appropriate patching methodologies when applying these patches totheir systems. We strongly recommend the use of back-ups and evaluating the impact of thesepatches in a Test and Development environment or on an offline infrastructure. Contact
Schneider Electric’s Customer Care Center if you need assistance removing a patch.

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 5 of 10

Schneider Electric Security Notification
We encourage customers to apply the remediations provided above and the mitigations
detailed here below to reduce the risk of exploit. Please note that Advisory-2023-04
vulnerability can only be mitigated.

Mitigations
Affected Product & Version

Mitigations
Schneider Electric is establishing a remediation plan for all
future versions that will include a fix for these vulnerabilities.
We will update this document when the remediations areavailable.

Easy Modicon M310
All versions

HMISCU Controller
Modicon Controller LMC078
Modicon Controller M241
Modicon Controller M251
Modicon Controller M262
Modicon Controller M258
Modicon Controller LMC058
Modicon Controller M218

Until then, customers should immediately apply the following
mitigations to reduce the risk of exploitation:• Ensure usage of user management and password
features. User rights are enabled by default andforced to create a strong password at first use.
• Restrict access to programming ports, typically
UDP/1740, TCP/11740 and TCP/484.
• Use controllers and devices only in a protectedenvironment to minimize network exposure andensure that they are not accessible from outside.
• Use firewalls to protect and separate the control
system network from other networks.
• Use VPN (Virtual Private Networks) tunnels if remote
access is required.
• Limit the access to both development and control
system by physical means, operating system
features, etc.
• Protect both development and control system byusing up to date malware protection.
To ensure you are informed of all updates, including details
on affected products and remediation plans, subscribe toSchneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp
Customers should immediately apply the following
mitigations to reduce the risk of exploitation:• Ensure usage of user management and password
features. User rights are enabled by default andforced to create a strong password at first use.
• Use encrypted communication links.
• The “Cybersecurity Guidelines for EcoStruxure
Machine Expert, Modicon and PacDrive Controllers
and Associated Equipment” provide mitigations

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 6 of 10

Schneider Electric Security Notification
PacDrive 3 Controllers LMC
Eco/Pro/Pro2
All versions

SoftSPS embedded in
EcoStruxure Machine Expert
All versions prior to Machine
Expert v2.2

•
•
•
•
•
•
•
•

through the activation of project encryption in the
Enhanced Security Settings, chapter
https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO00
00004242.
Restrict access to programming ports, typically
UDP/1740, TCP/11740 and TCP/1105.
Enable the optional ‘Implicit Checks’ on logic
applications.
Avoid use of the POINTER data type and
MEMMOVE instructions, especially on untrusted
inputs.
Use controllers and devices only in a protectedenvironment to minimize network exposure andensure that they are not accessible from outside.
Use firewalls to protect and separate the control
system network from other networks.
Use VPN (Virtual Private Networks) tunnels if remote
access is required.
Limit the access to both development and control
system by physical means, operating system
features, etc.
Protect both development and control system byusing up to date malware protection.

To ensure you are informed of all updates, including details
on affected products and remediation plans, subscribe toSchneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

Harmony iPC series with
Vijeo Designer runtime, Easy
Harmony HMIET6/HMIFT6
series,Magelis HMIGXU
All versions

Schneider Electric is establishing a remediation plan for all
future versions that will include a fix for these vulnerabilities.
We will update this document when the remediations areavailable. Until then, customers should immediately apply
the following mitigations to reduce the risk of exploitation.
• Ensure usage of user management and password
features.
• Use controllers and devices only in a protectedenvironment to minimize network exposure andensure that they are not accessible from outside.
• Use firewalls to protect and separate the control
system network from other networks.
• Use VPN (Virtual Private Networks) tunnels if remote
access is required.

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 7 of 10

Schneider Electric Security Notification••

Limit the access to both development and control
system by physical means, operating system
features, etc.
Protect both development and control system byusing up to date malware protection.

To ensure you are informed of all updates, including details
on affected products and remediation plans, subscribe toSchneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp
Customers should immediately apply the following
mitigations to reduce the risk of exploitation:•
Harmony (Formerly Magelis)
HMIGK/HMIGTO/HMIGTU/HM
IGTUX/HMISTU
All versions prior to v6.3 HF3•Magelis XBT series
All versions•••
Vijeo Designer embedded in
EcoStruxure™ Machine
ExpertAll versions prior to v6.3.1•

Ensure usage of user management and password
features.
Use controllers and devices only in a protectedenvironment to minimize network exposure andensure that they are not accessible from outside.
Use firewalls to protect and separate the control
system network from other networks.
Use VPN (Virtual Private Networks) tunnels if remote
access is required.
Limit the access to both development and control
system by physical means, operating system
features, etc.
Protect both development and control system byusing up to date malware protection.

To ensure you are informed of all updates, including details
on affected products and remediation plans, subscribe toSchneider Electric’s security notification service here:
https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

General Security Recommendations
We strongly recommend the following industry cybersecurity best practices.
••••

Locate control and safety system networks and remote devices behind firewalls andisolate them from the business network.
Install physical controls so no unauthorized personnel can access your industrial control
and safety systems, components, peripheral equipment, and networks.
Place all controllers in locked cabinets and never leave them in the “Program” mode.
Never connect programming software to any network other than the network intended forthat device.

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 8 of 10

Schneider Electric Security Notification••••

Scan all methods of mobile data exchange with the isolated network such as CDs, USB
drives, etc. before use in the terminals or any node connected to these networks.
Never allow mobile devices that have connected to any other network besides theintended network to connect to the safety or control networks without proper sanitation.
Minimize network exposure for all control system devices and systems and ensure thatthey are not accessible from the Internet.
When remote access is required, use secure methods, such as Virtual Private Networks(VPNs). Recognize that VPNs may have vulnerabilities and should be updated to themost current version available. Also, understand that VPNs are only as secure as theconnected devices.

For more information refer to the Schneider Electric Recommended Cybersecurity Best
Practices document.

For More Information
This document provides an overview of the identified vulnerability or vulnerabilities and actions
required to mitigate. For more details and assistance on how to protect your installation, contact
your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity
Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will befully aware of this situation and can support you through the process.
For further information related to cybersecurity in Schneider Electric’s products, visit thecompany’s cybersecurity support portal page:https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp

LEGAL DISCLAIMER
THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALSLINKED FROM IT (COLLECTIVELY, THIS “NOTIFICATION”) ARE INTENDED TO HELP PROVIDE AN
OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS,REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN“AS-IS” BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND. SCHNEIDER ELECTRICDISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED,INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE
IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY
DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING
DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL
DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCHDAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELYLIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY
RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHTTO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION.

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 9 of 10

Schneider Electric Security Notification
About Schneider Electric
Schneider’s purpose is to empower all to make the most of our energy and resources, bridging progress andsustainability for all. We call this Life Is On.
Our mission is to be your digital partner for Sustainability and Efficiency.
We drive digital transformation by integrating world-leading process and energy technologies, end-point to cloudconnecting products, controls, software and services, across the entire lifecycle, enabling integrated company
management, for homes, buildings, data centers, infrastructure and industries.
We are the most local of global companies. We are advocates of open standards and partnership ecosystems thatare passionate about our shared Meaningful Purpose, Inclusive and Empowered values.
www.se.com

Revision Control:
Version 1.0.0
11 July 2023

Original Release

Version 2.0.0
08 August 2023

New CODESYS advisories 2023-04 to 2023-09
added. Additional impacted product: Harmony andEasy Harmony, Vijeo Designer embedded in
EcoStruxure™ Machine Expert.

Version 3.0.0
09 January 2024

Remediations added for different products.

Version 4.0.0
12 March 2024

A remediation is now available for
HMIGK/HMIGTO/HMIGTU/ HMIGTUX/HMISTU
series.

Version 5.0.0
09 April 2024

A remediation is now available for Easy Harmony
HMIET6/HMIFT6, and Magelis HMIGXU series.

Version 6.0.0
11 June 2024

Easy Modicon M310 is added to the list of products
impacted.

CPCERT

Digitally signed by CPCERT
Date: 2024.09.09 12:16:28 -04'00'

11-Jul-23 (11-Jun-24) Document Reference Number – SEVD-2023-192-04 (v6.0.0) Page 10 of 10