SEVD-2021-194-05 — Easergy T200

Schneider Electric Security Notification 13-Jul-21 Document Reference Number – SEVD-2021-194-05 Page 1 of 4 ## Easergy T200 13 July 2021 ## Overview Schneider Electric is aware of a vulnerability in its Easergy T200 RTU (Remote Terminal Unit). The Easergy T200 RTU is a modular platform for medium voltage and low voltage public distribution network management. Failure to apply the mitigations provided below may allow authentication bypass during control command. ## Affected Products and Versions The communication board is impacted by this vulnerability and is the same for all T200 models (T200I/T200E , T200P ). The corresponding firmware depends on the protocol used. Impacted firmware versions are described in the table below: Product Version Easergy T200 (Modbus) SC2-04MOD-07000100 and earlier Easergy T200 (IEC104) SC2-04IEC-07000100 and earlier Easergy T200 (DNP3) SC2-04DNP-07000102 and earlier ## Vulnerability Details CVE ID: CVE-2021-22772 CVSS v3.1 Base Score 9.1 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause unauthorized operation when authentication is bypassed. Schneider Electric Security Notification 13-Jul-21 Document Reference Number – SEVD-2021-194-05 Page 2 of 4 ## Remediation Affected Product & Version Remediation Easergy T200 (Modbus) Customers are strongly encouraged to upgrade to version SC2-04MOD-07000103 available from the Schneider Electric Customer Care Center . Easergy T200 (IEC104) Customers are strongly encouraged to upgrade to version SC2-04IEC-07000103 available from the Schneider Electric Customer Care Center . Easergy T200 (DNP3) Customers are strongly encouraged to upgrade to version SC2-04DNP-07000103 available from the Schneider Electric Customer Care Center .