// Description
Schneider Electric Security Notification
9-Jun-20 Document Reference Number – SEVD-2020-161-01 Page 1 of 4
## Modicon M218 Logic Controller
9 June 2020
## Overview
Schneider Electric is aware of a vulnerability in the Modicon M218 Logic Controller product.
## Affected Product(s)
Modicon M218 firmware version 4.3 and prior
## Vulnerability Details
CVE ID: CVE-2020-7502
CVSS v3.0 Base Score 5.9 | Medium | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
A CWE-787: Out-of-bounds Write vulnerability exists, which may cause a Denial of Service when specific TCP/IP crafted packets are sent to the Modicon M218 Logic Controller.
## Remediation
The following workarounds and mitigations can be applied by customers to reduce the risk:
Since the vulnerability is present in the TCP/IP stack of the Modicon M218 Logic Controller product, an active network connection is required to exploit it. Therefore, Schneider Electric customers can act now to mitigate the risk of attack by limiting access to their devices, which would immediately reduce attempted exploits:
• Limit access to the networks on which Schneider Electric devices are placed.
• Do not expose Schneider Electric devices directly to the Internet.
• Always place Schneider Electric devices behind firewalls and/or other security protection
appliances that limit access only to authorized remote connections.
• Continuously monitor affected devices for security events that could warn of attempted unauthorized access.
• Secure the network communications between the engineering workstation and the controllers to ensure trustworthiness by following the Cybersecurity Best Practices
https://www.se.com/ww/en/download/document/CS-Best-Practices-2019-340/ Schneider Electric Security Notification
9-Jun-20 Document Reference Number – SEVD-2020-161-01 Page 2 of 4
For more details and assistance on how to protect your installation, please contact your local