Schneider Electric EcoStruxure (Update D)
Schneider Electric is aware of a vulnerability disclosed on Revenera FlexNet Publisher component. Many vendors, including Schneider Electric, embed Revenera FlexNet Publisher in their offers. Failure to apply the remediation/mitigations provided below may risk a local privilege escalation, which could lead to the execution of a malicious DLL with elevated privilege.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2024-2658US | — | — | ||
A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent directory. An unautho… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Revenera Advisoryexternal
- FlexNet Publisher Vulnerability - SEVD-2025-014-07 PDF Versionself
- FlexNet Publisher Vulnerability - SEVD-2025-014-07 CSAF Versionself
- ICS Advisory ICSA-25-037-02 JSONself
- ICS Advisory ICSA-25-037-02 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (25)
- MitigationEcoStruxure™ Architecture Builder
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Control Expert
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Control Expert Asset Link
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Machine Expert
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Machine Expert Safety
Schneider Electric is establishing a remediation plan for all future versions of the following that will include a fix for this vulnerability: • EcoStruxure™ Process Expert • EcoStruxure™ OPC UA Server Expert • EcoStruxure™ Machine SCADA Expert - Asset Link • EcoStruxure™ Operator Terminal Expert • EcoStruxure™ Machine Expert including EcoStruxure™ Machine Expert Safety • EcoStruxure™ Machine Expert Twin • Zelio Soft 2 We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true .
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Machine Expert Twin
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Machine SCADA Expert Asset Link
Schneider Electric is establishing a remediation plan for all future versions of the following that will include a fix for this vulnerability: • EcoStruxure™ Process Expert • EcoStruxure™ OPC UA Server Expert • EcoStruxure™ Machine SCADA Expert - Asset Link • EcoStruxure™ Operator Terminal Expert • EcoStruxure™ Machine Expert including EcoStruxure™ Machine Expert Safety • EcoStruxure™ Machine Expert Twin • Zelio Soft 2 We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true .
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ OPC UA Server Expert
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Operator Terminal Expert
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Process Expert
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationEcoStruxure™ Process Expert for AVEVA System Platform
Schneider Electric is establishing a remediation plan for all future versions of the following that will include a fix for this vulnerability: • EcoStruxure™ Process Expert • EcoStruxure™ OPC UA Server Expert • EcoStruxure™ Machine SCADA Expert - Asset Link • EcoStruxure™ Operator Terminal Expert • EcoStruxure™ Machine Expert including EcoStruxure™ Machine Expert Safety • EcoStruxure™ Machine Expert Twin • Zelio Soft 2 We will update this document when the remediation is available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true .
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationPro-face BLUE
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationVijeo Designer
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - MitigationZelio Soft 2
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Limit authenticated user access to the workstation and implement existing User Account Control practices. • Follow workstation, network and site-hardening guidelines in the Recommended Cybersecurity Best Practices guide available for download here.
https://www.se.com/ww/en/download/document/7EN52-0390/?ssr=true - BehobenEcoStruxure™ Architecture Builder
Version V7.0.18 of EcoStruxure™ Architecture Builder includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/195445393-ecostruxure-architecture-builder/ - software-and-firmware
https://www.se.com/ww/en/product-range/195445393-ecostruxure-architecture-builder/#software-and-firmware - BehobenEcoStruxure™ Control Expert
Version 16.2 of EcoStruxure™ Control Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/ Reboot the computer after installation is completed.
https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/ - BehobenEcoStruxure™ Control Expert Asset Link
Version V4.0SP1 of EcoStruxure™ Control Expert Asset Link includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/download/document/ECALV40SP1/
https://www.se.com/ww/en/product-range/548-ecostruxure-control-expert-unity-pro/ - BehobenEcoStruxure™ Machine Expert
Version v2.5.0.1 of EcoStruxure™ Machine Expert includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/ - BehobenEcoStruxure™ Machine Expert Twin
Version v2.3 of EcoStruxure™ Machine Expert Twin includes a fix for this vulnerability and can be installed through Schneider Electric Software Installer available here: https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/
https://www.se.com/ww/en/download/document/ESEMACS10_INSTALLER/ - BehobenEcoStruxure™ OPC UA Server Expert
Version SV2.01SP3 of EcoStruxure™ OPC UA Server Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/66388-ecostruxure-opc-ua-server-expert/#software-and-firmware
https://www.se.com/ww/en/product-range/66388-ecostruxure-opc-ua-server-expert/#software-and-firmware - BehobenEcoStruxure™ Operator Terminal Expert
Version 4.0 of EcoStruxure™ Operator Terminal Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/62621-ecostruxure-operator-terminal-expert/#software-and-firmware
https://www.se.com/ww/en/product-range/62621-ecostruxure-operator-terminal-expert/#software-and-firmware - BehobenEcoStruxure™ Process Expert
Version 2023 (v4.8.0.5715) of EcoStruxure™ Process Expert includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=65406
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=65406 - BehobenPro-face BLUE
Version 4.0 of Pro-face BLUE includes a fix for this vulnerability and is available for download here: https://www.proface.com/en/hmi_design_studio/blue/page/installer
https://www.proface.com/en/hmi_design_studio/blue/page/installer - BehobenVijeo Designer
Version V6.3SP1 HF1 of Vijeo Designer includes a fix for this vulnerability. Please contact your Schneider Electric Customer Support https://www.se.com/ww/en/work/support/country-selector/contact-us.jsp to get Vijeo Designer version V6.3SP1 HF1 software.
- BehobenZelio Soft 2
Version 5.4.3 of Zelio Soft 2 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/542-zelio-soft/#software-and-firmware
https://www.se.com/ww/en/product-range/542-zelio-soft/#software-and-firmware
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan