Modicon M218 Logic Controller

Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-03 Page 1 of 3 ## Modicon M218 Logic Controller 11 August 2020 ## Overview Schneider Electric is aware of a vulnerability in the Modicon M218 Logic Controller product. ## Affected Product(s) Modicon M218 Logic Controller V5.0.0.7 and prior ## Vulnerability Details CVE ID: CVE-2020-7524 CVSS v3.0 Base Score 5.9 | Medium | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H A CWE-787:Out-of-bounds Write vulnerability exists which could cause Denial of Service when sending specific crafted IPV4 packet to the controller: Sending a specific IPv4 protocol package to Schneider Electric Modicon M218 Logic Controller can cause IPv4 devices to go down. The device does not work properly and must be powered back on to return to normal. ## Remediation This vulnerability is fixed in version Firmware V5.0.0.8 and is available by contacting your Schneider Electric local support or distributor. Note : A reboot of the device is needed after update. The following workarounds and mitigations can be applied by customers to reduce the risk: • Setup network segmentation and implement a firewall to block all unauthorized access ## Product Information The Modicon M218 programmable controllers provide an optimized solution to repetitive machines based on high speed counting and simple positioning features. Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-03 Page 2 of 3 Product Category - All Categories > Learn more about Schneider Electric’s product categories here: https://www.se.com/us/en/all-products How to determine if you are affected Modicon M218 Logic Controller with Firmware V5.0.0.7 and prior versions are impacted ## General Security Recommendations We strongly recommend the following industry cybersecurity best practices.