// Description
Schneider Electric Security Notification
10-Mar-20 Document Reference Number – SEVD-2020 -070-03 Page 1 of 3
## ZigBee Installation Toolkit
10 March 2020
## Overview
Schneider Electric is aware of a vulnerability in the ZigBee Installation Toolkit product.
## Affected Product(s)
ZigBee Installation Kit versions prior to 1.0.1
## Vulnerability Details
CVE ID: CVE-2020-7476
CVSS v3.0 Base Score 6.6 | (Medium) | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
A CWE-426: Untrusted Search Path vulnerability exists which could cause execution of malicious code when a malicious file is put in the search path.
## Remediation
This vulnerability is fixed in version 1.0.1 and is available for download below:
https://www.se.com/ww/en/product-range-download/2723-ulti/#/software-firmware-tab
The following workarounds and mitigations can be applied by customers to reduce the risk:
• Updated anti-virus program
• Secure computer to prevent unauthorized users and unauthorized files
## Product Information
The ZigBee Installation Kit is used to configure the Ulti light switch.
Product Category - Residential and Small Business 10-Mar-20 Document Reference Number – SEVD-2020 -070-03 Page 2 of 3
# Schneider Electric Security Notification
> Learn more about Schneider Electric’s product categories here: www.schneider-electric.us/en/all-products
How to determine if you are affected
All versions prior to 1.0.1 are affected and should be upgraded
## General Security Recommendations
We strongly recommend following industry cybersecurity best practices such as:
• Locate control and safety system networks and remote devices behind firewalls, and isolate them from the business network.
• Physical controls should be in place so that no unauthorized person would have access to the ICS and safety controllers, peripheral equipment or the ICS and safety networks.