SEVD-2020-105-02 — Modicon M218/M241/M251/M258 Logic Controllers, SoMachine/SoMachine Motion, EcoStruxure™ Machine Expert (V1.1)

Schneider Electric Security Notification 14-Apr-20(10-Nov-20) Document Reference Number – SEVD-2020-105-02 V1.1 Page 1 of 4 ## Modicon M218/M241/M251/M258 Logic Controllers, SoMachine/SoMachine Motion, EcoStruxure™ Machine Expert (V1.1) 14 April 2020 (10 November 2020) # Overview Schneider Electric is aware of multiple vulnerabilities in the Modicon M218, M241, M251 and M258 Logic Controllers, SoMachine & SoMachine Motion, and EcoStruxure Machine Expert products. The Ecostruxure Machine Expert products are programmable logic controllers and associated programming software. Failure to apply the remediations provided below may risk denial of service or potential arbitrary code execution. Nov 2020 Update: Added remediation for M258 # Affected Products and Versions • EcoStruxure Machine Expert (all versions prior to v1.2) • SoMachine, SoMachine Motion (all versions) • Modicon M218 Logic Controller (all versions) • Modicon M241 Logic Controller (all versions prior to v5.0.8.4) • Modicon M251 Logic Controller (all versions prior to v5.0.8.4) • Modicon M258 Logic Controller (all versions prior to v5.0.4.11) # Vulnerability Details CVE ID: CVE-2020-7487 CVSS v3.0 Base Score 5.4 | Medium | CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists which could allow the attacker to execute malicious code on the Modicon M218, M241, M251, and M258 controllers. CVE ID: CVE-2020-7488 CVSS v3.0 Base Score 5.4 | Medium | CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H A CWE-319: Cleartext Transmission of Sensitive Information vulnerability exists which could leak sensitive information transmitted between the software and the Modicon M218, M241, M251, and M258 controllers. Schneider Electric Security Notification 14-Apr-20(10-Nov-20) Document Reference Number – SEVD-2020-105-02 V1.1 Page 2 of 4 # Remediation For Modicon M258 (all versions prior to V5.0.4.11 ):