IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2021-194-01 — EcoStruxure TM Control Expert, EcoStruxure TM Process Expert, SCADAPack RemoteConnect™ x70, and Modicon Controllers M580 and M340

CRITICAL
CVSS 9.8
Date 2026-10-16T20:34:17+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 13-Jul-21 (13-Aug-24) Document Reference Number – SEVD-2021-194-01 v9.0.0 Page 1 of 13 # EcoStruxure TM Control Expert, EcoStruxure TM Process Expert, SCADAPack RemoteConnect™ x70, and Modicon Controllers M580 and M340 13 July 2021 (13 August 2024) ## Overview Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert, SCADAPack RemoteConnect™ x70, and Modicon M580/ M580 Safety and M340 control products. These vulnerabilities pose several risks, primary among these is the possibility of arbitrary code execution and loss of confidentiality and integrity of the project file. With all products affected an attack would first involve an authenticated user gaining access to the engineering station; or an unauthenticated user gaining access to a project file or to the process control network. Our findings demonstrate that while the discovered vulnerabilities affect Schneider Electric offers, it is possible to mitigate the potential impacts by following standard guidance, specific instructions; and in some cases, the fixes provided by Schneider Electric to remove the vulnerabilities. Please ensure that if you are an EcoStruxure™ Control Expert user to apply the latest security updates provided below. For users of any of the mentioned products see the mitigation section in this security notice for further information on how to help protect your system from possible attack. Schneider Electric encourages all industrial companies to ensure they have implemented cybersecurity best practices across their operations and supply chains to reduce cyber risks. Where appropriate this includes locating industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; systematically applying security patches. August 2024 U

// Vulnerabilities (6)

CVE ID CVSS Score Severity Description
CVE-2021-22779 9.8 critical
Authentication Bypass by Spoofing vulnerability exists in EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), Modicon M340 CPU (all versions - part numbers BMXP34*), that could cause unauthorized access in read and write mode to the controller by spoofing the Modbus communication between the engineering software and the controller.
CVE-2020-12525 7.8 high
M&M Software fdtCONTAINER component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage. Note: This vulnerability could cause local code execution on the engineering workstation when a malicious project file is loaded into the engineering software.CVE-2020-12525 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVE-2021-22778 9.8 critical
An insufficiently protected credentials vulnerability exists that could cause protected derived function blocks to be read or modified by unauthorized users when accessing a project file. CVE-2021-22778 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).. --------- Begin Update A Part 2 of 2 --------CVE-2021-22778 has been assigned to this vulnerability. A CVSS v3 base score of 8.6 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
CVE-2021-22781 9.8 critical
An insufficiently protected credentials vulnerability exists that could cause a leak of SMTP credentials used for mailbox authentication when an attacker can access a project file.CVE-2021-22781 has been assigned to this vulnerability. A CVSS v3 base score of 6.2 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).
CVE-2021-22780 9.8 critical
An insufficiently protected credentials vulnerability exists that could cause unauthorized access to a project file protected by a password when this file is shared with untrusted sources. An attacker may bypass the password protection and be able to view and modify a project file.CVE-2021-22780 has been assigned to this vulnerability. A CVSS v3 base score of 7.1 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N).
CVE-2021-22782 9.8 critical
A missing encryption of sensitive data vulnerability exists that could cause an information leak allowing disclosure of network and process information, credentials, or intellectual property when an attacker can access a project file.CVE-2021-22782 has been assigned to this vulnerability. A CVSS v3 base score of 6.2 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

// Affected Products (27)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxure™ Process Expert for AVEVA System engineering_workstation
L3
2020_R2
Schneider Electric Schneider Electric EcoStruxure™ Process Expert engineering_workstation
L3
2020_R2
Schneider Electric Software, LLC Schneider Electric Software, LLC PLC Simulator for EcoStruxure Control Expert plc
L1
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC PLC Simulator for Unity Pro (former name of EcoStruxure Control Expert) plc
L1
vers:all/*
Schneider Electric Schneider Electric EcoStruxure Control Expert engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Process Expert 2023 engineering_workstation
L3
2023_v4.8.0.5715
Schneider Electric Software, LLC Schneider Electric Software, LLC Modicon M580 plc
L1
--
Schneider Electric Schneider Electric EcoStruxure™ Process Expert for AVEVA System Platform engineering_workstation
L3
2025
Schneider Electric Schneider Electric EcoStruxure Control Expert engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Control Expert engineering_workstation
L3
--
Schneider Electric Modicon M340 plc
L1
--
Schneider Electric Schneider Electric EcoStruxure™ Process Expert engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure Control Expert Asset Link engineering_workstation
L3
--
Schneider Electric Schneider Electric RemoteConnect and SCADAPack™ x70 Utilities - Security Administrator scada_server
L2
--
Schneider Electric Schneider Electric PLC Simulator for EcoStruxure™ Control Expert plc
L1
--
Schneider Electric Schneider Electric EcoStruxure Process Expert engineering_workstation
L3
2020_R2
Schneider Electric Schneider Electric EcoStruxure Process Expert engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure™ Control Expert Asset Link engineering_workstation
L3
--
Schneider Electric Schneider Electric EcoStruxure Process Expert 2023 engineering_workstation
L3
--
Schneider Electric Schneider Electric RemoteConnect and SCADAPack™ x70 Utilities - RemoteConnect scada_server
L2
--
Schneider Electric Schneider Electric EcoStruxure Process Expert for AVEVA System Platform engineering_workstation
L3
2020_R2
Schneider Electric Modicon M580 plc
L1
--
Schneider Electric Software, LLC Schneider Electric Software, LLC EcoStruxure Control Expert engineering_workstation
L3
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC SCADAPack RemoteConnect for x70 scada_server
L2
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC EcoStruxure Process Expert engineering_workstation
L3
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC Modicon M580 CPU (part numbers BMEP* and BMEH*) plc
L1
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC Modicon M340 CPU (part numbers BMXP34*) plc
L1
vers:all/*

// Remediations (9)

Mitigation: Schneider Electric provides detailed mitigation information for each of the affected products in the
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.
Mitigation: Use appropriate means to protect the project storage from unauthorized manipulation.
Use appropriate means to protect the project storage from unauthorized manipulation.
Mitigation: Exchange project data only via secure exchange services.
Exchange project data only via secure exchange services.
Mitigation: The CERT@VDE advisory for M&M Software also recommends the following mitigation practices:
The CERT@VDE advisory for M&M Software also recommends the following mitigation practices:
Mitigation: Emerson has published a notification (EMR.RMT20004.Rev3) for this vulnerability in RTIS. RTIS users
Emerson has published a notification (EMR.RMT20004.Rev3) for this vulnerability in RTIS. RTIS users should review this notification for additional information specific to RTIS. CERT@VDE has published an advisory (VDE-2021-001) for this vulnerability in PEPPERL+FUCHS PACTware. CERT@VDE has published an advisory (VDE-2021-002) for this vulnerability in Weidmüller FDT/DTM Software with WI Manager. Mitsubishi Electric has published advisory 2020-020 concerning the vulnerability in MELSOFT FieldDeviceConfigurator.
Patch: Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
Patch: Update the fdtCONTAINER component/fdtCONTAINER application to a version that provides a more secure
Update the fdtCONTAINER component/fdtCONTAINER application to a version that provides a more secure deserialization of the project data. This version will still use a deprecated serialization technology but will fix the currently known attack vector and will be compatible with existing, non-manipulated project files.
Mitigation: Do not open project data from an unknown source.
Do not open project data from an unknown source.
Mitigation: Reduce the user rights of the host application to the necessary minimum.
Reduce the user rights of the host application to the necessary minimum.

// References