CVE-2023-37556

Ein Hersteller-Fix ist verfügbar.

• BehobenACS880 IGBT Supply Control Programabb_psirt

  In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• BehobenACS880 Primary Control Programabb_psirt

  In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• BehobenACS5000abb_psirt

  ABB recommends that customers apply a firmware update as soon as possible to the latest firmware, i.e. LAAAB v. 5.07 and higher, for the affected products. ABB has addressed the CODESYS Runtime System vulnerabilities by disabling the IEC online programming communication by default. As a result, CODESYS communication between affected products and the ABB Automation Builder or ABB Drive Application Builder tools is disabled. It should be noted that the CODESYS application continues to run on the Drive and if it is necessary to establish communication with CODESYS RTS, for example to debug the CODESYS application, this is possible through the drive parameter configuration. Open the user lock via the "96.02 Pass code" parameter and make sure that bit 9 "Enable online IEC programming" is set to TRUE in the "96.102 User lock functionality" parameter. IMPORTANT: After this task, be sure to disable CODESYS communication by setting the bit back to FALSE. A future firmware update is planned to update the CODESYS RTS library, which will further strengthen defenses for the vulnerabilities mentioned above. For situations where firmware update is not feasible, please refer to “Workarounds” section.

• BehobenACS6000abb_psirt

  ABB recommends that customers apply a firmware update as soon as possible to the latest firmware, i.e. LAAAB v. 5.07 and higher, for the affected products. ABB has addressed the CODESYS Runtime System vulnerabilities by disabling the IEC online programming communication by default. As a result, CODESYS communication between affected products and the ABB Automation Builder or ABB Drive Application Builder tools is disabled. It should be noted that the CODESYS application continues to run on the Drive and if it is necessary to establish communication with CODESYS RTS, for example to debug the CODESYS application, this is possible through the drive parameter configuration. Open the user lock via the "96.02 Pass code" parameter and make sure that bit 9 "Enable online IEC programming" is set to TRUE in the "96.102 User lock functionality" parameter. IMPORTANT: After this task, be sure to disable CODESYS communication by setting the bit back to FALSE. A future firmware update is planned to update the CODESYS RTS library, which will further strengthen defenses for the vulnerabilities mentioned above. For situations where firmware update is not feasible, please refer to “Workarounds” section.

• BehobenACS6080abb_psirt

  ABB recommends that customers apply a firmware update as soon as possible to the latest firmware, i.e. LAAAB v. 5.07 and higher, for the affected products. ABB has addressed the CODESYS Runtime System vulnerabilities by disabling the IEC online programming communication by default. As a result, CODESYS communication between affected products and the ABB Automation Builder or ABB Drive Application Builder tools is disabled. It should be noted that the CODESYS application continues to run on the Drive and if it is necessary to establish communication with CODESYS RTS, for example to debug the CODESYS application, this is possible through the drive parameter configuration. Open the user lock via the "96.02 Pass code" parameter and make sure that bit 9 "Enable online IEC programming" is set to TRUE in the "96.102 User lock functionality" parameter. IMPORTANT: After this task, be sure to disable CODESYS communication by setting the bit back to FALSE. A future firmware update is planned to update the CODESYS RTS library, which will further strengthen defenses for the vulnerabilities mentioned above. For situations where firmware update is not feasible, please refer to “Workarounds” section.

• Behobencodesys_psirt

  Update the following products to version 3.5.19.20. - CODESYS Control RTE (SL) - CODESYS Control RTE (for Beckhoff CX) SL - CODESYS Control Win (SL) - CODESYS Control Runtime System Toolkit - CODESYS Safety SIL2 Runtime Toolkit - CODESYS Safety SIL2 PSP - CODESYS HMI (SL) - CODESYS Development System V3 Update the following products to version to 4.10.0.0. This version is scheduled for October 2023. - CODESYS Control for BeagleBone SL - CODESYS Control for emPC-A/iMX6 SL - CODESYS Control for IOT2000 SL - CODESYS Control for Linux SL - CODESYS Control for PFC100 SL - CODESYS Control for PFC200 SL - CODESYS Control for PLCnext SL - CODESYS Control for Raspberry Pi SL - CODESYS Control for WAGO Touch Panels 600 SL The CODESYS Development System and the products available as CODESYS add-ons can be downloaded and installed directly with the CODESYS Installer or be downloaded from the CODESYS Store. Alternatively, as well as for all other products, you will find further information on obtaining the software update in the CODESYS Update area.

• Behobenwago_psirt

  ### Fixed Firmware 3 | Product | Status | |-------------|-----------| | 750-8000 | available | | 750-8001 | available | ### Fixed Firmware 26 #### Compact Controller 100 family | Product | Status | |---------------------|-----------| | 751-9301/xxx-xxx | available | | 751-9401/xxx-xxx | available | #### PFC 100 family | Product | Status | |---------------------|-----------| | 750-8100/xxx-xxx | available | | 750-8101/xxx-xxx | available | | 750-8102/xxx-xxx | available | #### PFC 200 family | Product | Status | |---------------------|-----------| | 750-8202/xxx-xxx | available | | 750-8203/xxx-xxx | available | | 750-8204/xxx-xxx | available | | 750-8206/xxx-xxx | available | | 750-8207/xxx-xxx | available | | 750-8210/xxx-xxx | available | | 750-8211/xxx-xxx | available | | 750-8212/xxx-xxx | available | | 750-8213/xxx-xxx | available | | 750-8214/xxx-xxx | available | | 750-8215/xxx-xxx | available | | 750-8216/xxx-xxx | available | | 750-8217/xxx-xxx | available | #### TP 600 family | Product | Status | |------------------------|-----------| | 762-4x0x/8000-000x | available | | 762-5x0x/8000-000x | available | | 762-6x0x/8000-000x | available | #### EC 300 family | Product | Status | |------------------------|-----------| | 752-8303/8000-0002 | available | ### Fixed Firmware 22 Patch 2 #### Compact Controller 100 family | Product | Status | |---------------------|-----------| | 751-9301/xxx-xxx | planned | | 751-9401/xxx-xxx | planned | #### PFC 100 family | Product | Status | |---------------------|-----------| | 750-8100/xxx-xxx | planned | | 750-8101/xxx-xxx | planned | | 750-8102/xxx-xxx | planned | #### PFC 200 family | Product | Status | |---------------------|-----------| | 750-8202/xxx-xxx | planned | | 750-8203/xxx-xxx | planned | | 750-8204/xxx-xxx | planned | | 750-8206/xxx-xxx | planned | | 750-8207/xxx-xxx | planned | | 750-8210/xxx-xxx | planned | | 750-8211/xxx-xxx | planned | | 750-8212/xxx-xxx | planned | | 750-8213/xxx-xxx | planned | | 750-8214/xxx-xxx | planned | | 750-8215/xxx-xxx | planned | | 750-8216/xxx-xxx | planned | | 750-8217/xxx-xxx | planned | #### TP 600 family | Product | Status | |------------------------|-----------| | 762-4x0x/8000-000x | planned | | 762-5x0x/8000-000x | planned | | 762-6x0x/8000-000x | planned | #### EC 300 family | Product | Status | |------------------------|-----------| | 752-8303/8000-0002 | planned | A fixed version of e!COCKPIT is planned.

• BehobenACS880 IGBT Supply Control Programcisa_csaf_ot

  In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• BehobenACS880 Primary Control Programcisa_csaf_ot

  In latest firmware versions for the affected products, ABB has mitigated the CODESYS Runtime System vulnerabilities. IEC online programming communication is disabled by default. As a result, CODESYS tools communication with the drive is disabled. ABB recommends that customers apply the firmware update at earliest convenience. For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• BehobenACS5000cisa_csaf_ot

  ABB recommends that customers apply a firmware update as soon as possible to the latest firmware, i.e. LAAAB v. 5.07 and higher, for the affected products. ABB has addressed the CODESYS Runtime System vulnerabilities by disabling the IEC online programming communication by default. As a result, CODESYS communication between affected products and the ABB Automation Builder or ABB Drive Application Builder tools is disabled. It should be noted that the CODESYS application continues to run on the Drive and if it is necessary to establish communication with CODESYS RTS, for example to debug the CODESYS application, this is possible through the drive parameter configuration. Open the user lock via the "96.02 Pass code" parameter and make sure that bit 9 "Enable online IEC programming" is set to TRUE in the "96.102 User lock functionality" parameter. IMPORTANT: After this task, be sure to disable CODESYS communication by setting the bit back to FALSE. A future firmware update is planned to update the CODESYS RTS library, which will further strengthen defenses for the vulnerabilities mentioned above. For situations where firmware update is not feasible, please refer to “Workarounds” section.

• BehobenACS6000cisa_csaf_ot

  ABB recommends that customers apply a firmware update as soon as possible to the latest firmware, i.e. LAAAB v. 5.07 and higher, for the affected products. ABB has addressed the CODESYS Runtime System vulnerabilities by disabling the IEC online programming communication by default. As a result, CODESYS communication between affected products and the ABB Automation Builder or ABB Drive Application Builder tools is disabled. It should be noted that the CODESYS application continues to run on the Drive and if it is necessary to establish communication with CODESYS RTS, for example to debug the CODESYS application, this is possible through the drive parameter configuration. Open the user lock via the "96.02 Pass code" parameter and make sure that bit 9 "Enable online IEC programming" is set to TRUE in the "96.102 User lock functionality" parameter. IMPORTANT: After this task, be sure to disable CODESYS communication by setting the bit back to FALSE. A future firmware update is planned to update the CODESYS RTS library, which will further strengthen defenses for the vulnerabilities mentioned above. For situations where firmware update is not feasible, please refer to “Workarounds” section.

• BehobenACS6080cisa_csaf_ot

  ABB recommends that customers apply a firmware update as soon as possible to the latest firmware, i.e. LAAAB v. 5.07 and higher, for the affected products. ABB has addressed the CODESYS Runtime System vulnerabilities by disabling the IEC online programming communication by default. As a result, CODESYS communication between affected products and the ABB Automation Builder or ABB Drive Application Builder tools is disabled. It should be noted that the CODESYS application continues to run on the Drive and if it is necessary to establish communication with CODESYS RTS, for example to debug the CODESYS application, this is possible through the drive parameter configuration. Open the user lock via the "96.02 Pass code" parameter and make sure that bit 9 "Enable online IEC programming" is set to TRUE in the "96.102 User lock functionality" parameter. IMPORTANT: After this task, be sure to disable CODESYS communication by setting the bit back to FALSE. A future firmware update is planned to update the CODESYS RTS library, which will further strengthen defenses for the vulnerabilities mentioned above. For situations where firmware update is not feasible, please refer to “Workarounds” section.

• BehobenEasy Harmony HMIET6/HMIFT6 Magelis HMIGXU seriescisa_csaf_ot

  Vijeo Designer Basic v2.0 HotFix 2 includes a fix for this vulnerability. Please contact your Schneider Electric Customer Care Center to obtain the installer. To complete the update, connect to Harmony HMI and download the firmware using Vijeo Designer Basic.

  https://www.se.com/us/en/work/support/contacts.jsp↗
• BehobenEasy Modicon M310cisa_csaf_ot

  Version 3.1.5.82 includes a fix for this vulnerability and can be download here: https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 As an alternative, contact your Schneider Electric Customer Care Center to obtain the firmware. To complete the update, connect to M310 and download the firmware using EcoStruxureTM Motion Expert.

  https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310↗
• BehobenHMISCU Controllercisa_csaf_ot

  Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.

  https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware↗
• BehobenHarmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU seriescisa_csaf_ot

  Version 6.3 HF3 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Hot Fix. For additional detail please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 HF3 of Vijeo Designer.

• BehobenModicon Controller M241cisa_csaf_ot

  Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.

  https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/↗
• BehobenModicon Controller M251cisa_csaf_ot

  Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.

  https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/↗
• BehobenModicon Controller M262cisa_csaf_ot

  Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.

  https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/↗
• BehobenPacDrive 3 Controllers: LMC Eco/Pro/Pro2 cisa_csaf_ot

  PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.

  https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/↗
• BehobenSchneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony P6 seriescisa_csaf_ot

  Version 6.3 SP2 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Fix. For additional details, please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 SP2 of Vijeo Designer.

  https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware↗
• BehobenSchneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony iPC seriescisa_csaf_ot

  Version 6.3 SP2 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware As an alternative, please contact your Schneider Electric Customer Care Center to obtain the Fix. For additional details, please refer to the supplied help file in Hot Fix. On the engineering workstation, update to v6.3 SP2 of Vijeo Designer.

  https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware↗
• BehobenSoftSPS embedded in EcoStruxure Machine Expertcisa_csaf_ot

  SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application.

  https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/↗
• BehobenVijeo Designer embedded in EcoStruxure Machine Expert cisa_csaf_ot

  Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.

  https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware↗
• MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0festo_psirt

  Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

• MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10festo_psirt

  Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

• Mitigationcodesys_psirt

  To exploit these vulnerabilities, a successful login to the affected product is required. The online user management therefore protects from exploiting these security vulnerabilities. CODESYS GmbH strongly recommends using the online user management. This not only prevents an attacker from sending malicious requests or downloading virulent code, but also suppresses starting, stopping, debugging or other actions on a known working application that could potentially disrupt a machine or system. As of version 3.5.17.0, the online user management is enforced by default.

• Mitigationwago_psirt

  Depending on the vulnerability there are possible mitigations: Vulnerability of CODESYS Advisory 2023-05: - This vulnerability exists in the CODESYS programming service which is needed for commission only. Deactivate the CODESYS programming port in the web-based management if you do not need the service. In addition to the mitigation hints CODESYS GmbH recommends the following general defense measures to reduce the risk of exploits: - Use controllers and devices only in a protected environment to minimize network exposure and ensure they are not accessible from outside. - Use firewalls to protect and separate the control system network from other networks. - Use VPN (Virtual Private Networks) tunnels if remote access is required. - Activate and apply user management and password features. - Use encrypted communication links. - Limit the access to both development and control system by physical means, operating system features, etc. - Protect both development and control system by using up to date virus detection solutions. For further impact information and risk mitigation, please refer to the official CODESYS Advisory Website at https://www.codesys.com/security/security-reports.html

• MitigationEasy Modicon M310cisa_csaf_ot

  Customers should immediately apply the following mitigations to reduce the risk of exploitation: • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.• Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.• Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.• Use firewalls to protect and separate the control system network from other networks.• Use VPN (Virtual Private Networks) tunnels if remote access is required. • Limit the access to both development and control system by physical means, operating system features, etc. • Protect both development and control system by using up to date malware protection.

• MitigationHMISCU Controllercisa_csaf_ot

  • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

• MitigationModicon Controller LMC058cisa_csaf_ot

  • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

• MitigationModicon Controller M241cisa_csaf_ot

  • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

• MitigationModicon Controller M251cisa_csaf_ot

  • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

• MitigationModicon Controller M258cisa_csaf_ot

  • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

• MitigationModicon Controller M262cisa_csaf_ot

  • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

• MitigationPacDrive 3 Controllers: LMC Eco/Pro/Pro2 cisa_csaf_ot

  • Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. • Use encrypted communication links. • The “Cybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment” provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide&p_File_Name=EIO0000004242.00.pdf&p_Doc_Ref=EIO0000004242. • Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.

• MitigationSoftSPS embedded in EcoStruxure Machine Expertcisa_csaf_ot

  • Enable the optional ‘Implicit Checks’ on logic applications. • Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. • Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. • Use firewalls to protect and separate the control system network from other networks. • Use VPN (Virtual Private Networks) tunnels if remote access is required. • Limit the access to both development and control system by physical means, operating system features, etc. • Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp

• MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.0cisa_csaf_ot

  Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

• MitigationFesto Automation Suite <2.8.0.138 installed with CODESYS Development System 3.5.16.10cisa_csaf_ot

  Starting from Festo Automation Suite version 2.8.0.138, Codesys is no longer bundled with the suite and must be downloaded and installed separately by the customer. To mitigate this vulnerability customers are advised to: Download the latest, patched version of Codesys directly from the official Codesys website. Follow the installation and update instructions provided by Codesys to ensure all security fixes are applied. Regularly monitor Codesys security advisories and apply updates promptly. Maintain the Festo Automation Suite connector up to date by installing FAS updates as released by Festo.

• WorkaroundACS880 Position Control Programabb_psirt

  For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• WorkaroundACS880 Test Bench Control Programabb_psirt

  For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• WorkaroundABB Drive Application Builder license (IEC 61131-3)abb_psirt

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• WorkaroundDCCabb_psirt

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• WorkaroundDEMagabb_psirt

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• WorkaroundPower Optimizerabb_psirt

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• WorkaroundACS880 Position Control Programcisa_csaf_ot

  For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• WorkaroundACS880 Test Bench Control Programcisa_csaf_ot

  For situations where firmware update is not feasible, please refer to ‘Workarounds’ section guidance

• WorkaroundABB Drive Application Builder license (IEC 61131-3)cisa_csaf_ot

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• WorkaroundDCCcisa_csaf_ot

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• WorkaroundDEMagcisa_csaf_ot

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• WorkaroundPower Optimizercisa_csaf_ot

  If the drive or power controller is in an exploitable configuration, ABB recommends immediately applying the mitigations described in the Workarounds section.

• Kein Fix geplantMagelis XBT seriescisa_csaf_ot

  Schneider Electric’s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven't been replaced, please contact your local Schneider Electric technical support for more information.