Modicon Managed Switch

Schneider Electric Security Notification 11-May-21 Document Reference Number – SEVD-2021 -130-01 Page 1 of 3 ## Modicon Managed Switch 11 May 2021 ## Overview Schneider Electric is aware of a vulnerability in its Modicon Managed Switch products. The Modicon Managed Switch products are designed for the special requirements of industrial automation. The devices allow users to set up switched Industrial Ethernet networks. Failure to apply the firmware upgrade or mitigations provided below may allow an attacker to change the password of any user, which could cause all or part of the switch to be controlled by the attacker. That could result in various attack types like denial of service or provide access to unauthorized devices on the network. ## Affected Product and Versions Modicon Managed Switch MCSESM* and MCSESP* V8.21 and prior ## Vulnerability Details CVE: CVE-2021-22731 CVSS v3.1 Base Score 9.8 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause an unauthorized password change through HTTP / HTTPS when basic user information is known by a remote attacker. ## Remediation Version 8.22 of the Modicon Managed Switch products includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range-download/584-modicon-switch/?selected-node-id=12144236472#/software-firmware-tab The upgrade procedure is detailed in the MCSESM, MCSESM-E Managed Switch User Manual Configuration available below, is also applicable for MCSESP references. It is important to note that the upgrade procedure must be applied twice with the same version to prevent rollback. User Manual Configuration: https://download.schneider-electric.com/files?p_Doc_Ref=QGH59056