Modicon LMC078 Logic Controller additional URGENT/11 Fix

Schneider Electric Security Notification 9-Jun-20 Document Reference Number – SEVD-2020 -161-03 Page 1 of 4 ## Modicon LMC078 Logic Controller additional URGENT/11 Fix 9 June 2020 ## Overview Schneider Electric is aware of a vulnerability introduced in the VxWorks patch delivered by Wind River fixing URGENT/11 vulnerabilities affecting the Modicon LMC078 Logic Controller. ## Affected Product(s) Modicon LMC078 Logic Controller running with firmware version V1.51.15.05 and later ## Vulnerability Details CVE ID: CVE-2020-10664 CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The IGMP component in VxWorks 6.8.3 IPNET CVE patches created in 2019 has a NULL Pointer Dereference. Additional details on this specific vulnerability can be found on the Wind River security notification webpage: https://support2.windriver.com/index.php?page=cve&on=view&id=CVE-2020-10664 ## Remediation Modicon LMC078 Logic Controller does not allow IGMP communication protocol by default. No configuration or Schneider feature allows joining a multicast source group. The following workarounds and mitigations can be applied by customers to enforce cybersecurity on Modicon LMC078 Logic Controllers: Since the vulnerability is present in the TCP/IP stack, an active network connection is required to exploit it. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices, which would immediately reduce attempted exploits. Schneider Electric Security Notification 9-Jun-20 Document Reference Number – SEVD-2020 -161-03 Page 2 of 4 • Use functions recommended and documented by Schneider Electric: https://product-help.schneider-electric.com/Machine%20Expert/V1.2/LandingPages/en/VLP_Software/VLP_Lib_Te mp_Ex/VLP_Libraries/VLP_Communication_Libraries/index.html • Limit access to the networks on which Schneider Electric devices are placed.