Vijeo Designer and Vijeo Designer Basic Software (V1.1)

Schneider Electric Security Notification 12-May-20 (11-Aug-20) Document Reference Number – SEVD-2020 -133-02 V1.1 Page 1 of 4 ## Vijeo Designer and Vijeo Designer Basic Software (V1.1) 12 May 2020 (11 August 2020) ## Overview Schneider Electric is aware of a vulnerability in the Vijeo Designer Basic and Vijeo Designer software products. ## Affected Product(s) • Vijeo Designer Basic V1.1 HotFix 16 and prior • Vijeo Designer V6.2 SP9 and prior ## Vulnerability Details CVE ID: CVE-2020-7501 CVSS v3.0 Base Score 8.6 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H A CWE-798: Use of Hard-coded Credentials vulnerability exists which could cause unauthorized read and write when downloading and uploading project or firmware into Vijeo Designer Basic and Vijeo Designer. ## Remediation This vulnerability is fixed in version Vijeo Designer Basic V1.1 HotFix 17. Please contact your Schneider Electric Customer Support to obtain the HotFix. This vulnerability is fixed in version Vijeo Designer V6.2 SP10 released in July 2020. • For customers using Vijeo Designer version V6.1 or earlier, please contact your Schneider Electric Customer Support to obtain the Vijeo Designer V6.2 SP10. • For customers using a version of Vijeo Designer V6.2 or greater, Vijeo Designer V6.2 SP10 will be automatically available in Schneider Electric Software Update (SESU) software. The following workarounds and mitigations can be applied to Vijeo Designer Basic and Vijeo Designer by customers to reduce the risk: Schneider Electric Security Notification 12-May-20 (11-Aug-20) Document Reference Number – SEVD-2020 -133-02 V1.1 Page 2 of 4 • Enable “Download security” to override its hardcoded password and refer to “4.8.2.2 Protecting Targets from Unauthorized Project Downloads” in online help. • Setup network segmentation and implement a firewall to block all unauthorized access to port TCP/6001 (Not standard FTP port). ## Product Information