Modicon Quantum Ethernet Network module and

Schneider Electric Security Notification 10-Mar-20 Document Reference Number – SEVD-2020 -070-02 Page 1 of 4 ## Modicon Quantum Ethernet Network module and ## Quantum / Premium COPRO 10 March 2020 ## Overview Schneider Electric is aware of a vulnerability in the Quantum Ethernet Network module and Quantum/Premium COPRO. ## Affected Product(s) • Quantum Ethernet Network module 140NOE771x1, versions 7.0 and prior • Quantum processors with integrated Ethernet – 140CPU65xxxxx, all versions • Premium processors with integrated Ethernet, all versions ## Vulnerability Details CVE ID: CVE-2020-7477 CVSS v3.0 Base Score 7.5 | (High) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists which could cause a Denial of Service when sending a specially crafted command over Modbus. ## Remediation Quantum Ethernet Network module 140NOE771x1 This vulnerability is fixed in version 7.1 and is available for download below: • 140NOE77101: https://www.se.com/ww/en/download/document/140NOE77101+Exec+and+Release+Notes/ • 140NOE77111: https://www.se.com/ww/en/download/document/140NOE77111+Exec+and+Release+Notes+For+ Unity+and+Non+Unity+Users/ Schneider Electric Security Notification 10-Mar-20 Document Reference Number – SEVD-2020 -070-02 Page 2 of 4 Quantum / Premium COPRO Schneider Electric’s Modicon Quantum / Premium controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon M580 ePAC controller, our current product offer. Customers should strongly consider migrating to the ModiconM580 ePAC. Please contact your local Schneider Electric technical support for more information. To mitigate the risks associated with this vulnerability, users should immediately: • Setup network segmentation and implement a firewall to block all unauthorized access to port TCP/502 Quantum: