Smartlink, PowerTag, and Wiser Series Gateways

Schneider Electric Security Notification 13-Oct-20 Document Reference Number – SEVD-2020 -287-03 Page 1 of 3 ## Smartlink, PowerTag, and Wiser Series Gateways 13 October 2020 # Overview Schneider Electric is aware of a vulnerability in its Smartlink, PowerTag, and Wiser series gateways. Failure to apply the mitigation provided below may risk unauthorized access to the product. # Affected Product and Version • Acti9 Smartlink SI D all versions prior to 002.004.002 • Acti9 Smartlink SI B all versions prior to 002.004.002 • Acti9 PowerTag Link / Link HD all versions prior to 001.008.007 • Acti9 Smartlink EL B all versions prior to 1.2.1 • Wiser Link all versions prior to 1.5.0 • Wiser Energy all versions prior to 1.5.0 # Vulnerability Details CVE ID: CVE-2020-7548 CVSS v3.0 Base Score 7.1 | High | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H A CWE-330 - Use of Insufficiently Random Values vulnerability exists that could allow unauthorized users to login. # Remediation Customers with impacted Smartlink SI B/D and PowerTag Link products should update to the latest firmware using EcoStruxure Power Comission installer v.7.0 available here: https://www.se.com/ww/en/product-range-download/64482-acti9-powertag-link/?selected-node-id=12492093362#/software-firmware-tab Customers with impacted Wiser Link, Wiser Energy, and Smartlink EL B products should immediately use the eSetup app to download version 1.5.0 for Wiser Link, Wiser Energy; version 1.2.1 for Smartlink EL B. # General Security Recommendations We strongly recommend the following industry cybersecurity best practices. • Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Schneider Electric Security Notification 13-Oct-20 Document Reference Number – SEVD-2020 -287-03 Page 2 of 3