MSX Configurator

Schneider Electric Security Notification 14-Jan-20 Document Reference Number – SEVD-2020 -014-01 Page 1 of 3 ## MSX Configurator 14 January 2020 ## Overview Schneider Electric is aware of a vulnerability in the MSX Configurator product. ## Affected Product(s) MSX Configurator software version prior to V1.0.8.1 ## Vulnerability Details CVE ID: CVE-2019-6858 CVSS v3.0 Base Score 5.6 | (Medium) | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H A CWE-427:Uncontrolled Search Path Element vulnerability exists which could cause privilege escalation when injecting a malicious DLL. ## Remediation This vulnerability is fixed in version V1.0.8.1 MSX Configurator software and is available for download below: https://www.se.com/ww/en/download/document/MSX+Configurator/ ## Product Information MSX configurator is a tool which allows the architecture to be configured using any of the Modicon M221, M241 and M251 controllers and associated TM3 and TM4 I/O offers. Product Category - Industrial Automation Control Learn more about Schneider Electric’s product categories here: www.schneider-electric.us/en/all-products Schneider Electric Security Notification 14-Jan-20 Document Reference Number – SEVD-2020 -014-01 Page 2 of 3 How to determine if you are affected Software version prior to V1.0.8.1 is impacted. ## General Security Recommendations We strongly recommend following industry cybersecurity best practices such as: • Locate control and safety system networks and remote devices behind firewalls, and isolate them from the business network. • Physical controls should be in place so that no unauthorized person would have access to the ICS and safety controllers, peripheral equipment or the ICS and safety networks. • All controllers should reside in locked cabinets and never be left in the “Program” mode.