Vijeo Designer and Vijeo Designer Basic (V1.2)

Schneider Electric Security Notification 14-Apr-20 (11-Aug-20) Document Reference Number – SEVD-2020 -105-03 V1.2 Page 1 of 4 ## Vijeo Designer and Vijeo Designer Basic (V1.2) 14 April 2020 (11 August 2020) ## Overview Schneider Electric is aware of a vulnerability in the Vijeo Designer and Vijeo Designer Basic Software products. ## Affected Product(s) • Vijeo Designer Basic V1.1 HotFix 15 and prior • Vijeo Designer V6.2 SP9 and prior ## Vulnerability Details CVE ID: CVE-2020-7490 CVSS v3.0 Base Score 6.7 | (Medium) | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H A CWE-426: Untrusted Search Path vulnerability exists, which could cause arbitrary code execution on the system running Vijeo Basic when a malicious DLL library is loaded by the product. ## Remediation This vulnerability is fixed in Vijeo Designer Basic version V1.1 HotFix 16. Please contact your Schneider Electric Customer Support to get Vijeo Designer Basic version V1.1 HotFix 16 software. This vulnerability is fixed in version Vijeo Designer V6.2 SP10 released in July 2020: • For customers using Vijeo Designer version V6.1 or earlier, please contact your Schneider Electric Customer Support to obtain the Vijeo Designer V6.2 SP10. • For customers using a version of Vijeo Designer V6.2 or greater, Vijeo Designer V6.2 SP10 will be automatically available in Schneider Electric Software Update (SESU) software. The following workarounds and mitigations can be applied to Vijeo Designer Basic and Vijeo Designer by customers to reduce the risk: Schneider Electric Security Notification 14-Apr-20 (11-Aug-20) Document Reference Number – SEVD-2020 -105-03 V1.2 Page 2 of 4 • Harden the Engineering Workstation - follow workstation, network, and site hardening guidelines in the Cybersecurity Best Practices guide available for download here . ## Product Information