// Description
Schneider Electric Security Notification
20-Mar-20(11 May 2021) Document Reference Number – SEVD-2020 -080-01 V3.0 Page 1 of 7
## Modicon Controllers, EcoStruxure™ Control Expert and Unity Pro Programming Software (V3.0)
20 March 2020 (11 May 2021)
# Overview
Researchers from Airbus Cybersecurity have made Schneider Electric aware of a vulnerability in two versions of Schneider Electric’s Modicon programmable controllers and its EcoStruxure Control Expert (formerly Unity Pro) programming software.
Since alerting us to the vulnerability, Airbus Cybersecurity and Schneider Electric have collaborated to validate the research and to assess its true impact. Our mutual findings demonstrate that while the discovered vulnerability affects Schneider Electric offers, it equally impacts many other vendors and the global industrial automation market in general, especially when the baseline assumption of the attack technique Airbus Cybersecurity demonstrated is considered. Given certain conditions, and assuming an attacker has access to the network, many devices available from several different industrial control vendors are likewise vulnerable.
Details of the vulnerability and a remediation are included below. However, as a general guideline, Schneider Electric and Airbus Cybersecurity encourage all industrial companies to ensure they have implemented cybersecurity best practices across their operations and supply chains to reduce cyber risks. Where appropriate this includes locating industrial systems and remotely accessible devices behind firewalls; installing physical controls to prevent unauthorized access; preventing mission-critical systems and devices from being accessed from outside networks; systematically applying security patches and activating antivirus software; and applying whitelisting solutions .
For more detail on Airbus Cybersecurity’s research, please visit their blog .