Modicon M100/M200/M221 controllers, SoMachine Basic and EcoStruxure Machine Expert - Basic Programming Software

Schneider Electric Security Notification 14-Apr-20 Document Reference Number – SEVD-2020 -105-01 Page 1 of 4 ## Modicon M100/M200/M221 controllers, SoMachine Basic and EcoStruxure Machine Expert - Basic Programming Software 14 April 2020 ## Overview Schneider Electric is aware of a vulnerability in the Modicon M100/M200/M221 controllers, SoMachine Basic and EcoStruxure Machine Expert - Basic products. ## Affected Product(s) SoMachine Basic (all versions) EcoStruxure Machine Expert – Basic (all versions) Modicon M100 Logic Controller (all versions) Modicon M200 Logic Controller (all versions) Modicon M221 Logic Controller (all versions) ## Vulnerability Details CVE ID: CVE-2020-7489 CVSS v3.0 Base Score 8.2 | High | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H A CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability exists in EcoStruxure Machine Expert – Basic or SoMachine Basic programming software. The result of this vulnerability, DLL substitution, could allow the transference of malicious code to the controller. ## Remediation The following workarounds and mitigations can be applied by customers to reduce the risk. All steps are required. STEP 1: Update software and firmware. • On the engineering workstation, update to EcoStruxure Machine Expert - Basic V1.0 SP2 or above: https://www.se.com/fr/fr/product-range-download/2226-ecostruxure%E2%84%A2-machine-expert/#/software-firmware-tab • On Modicon M100/M200/M221 Logic controllers, update to latest firmware version. Schneider Electric Security Notification 14-Apr-20 Document Reference Number – SEVD-2020 -105-01 Page 2 of 4 STEP 2: Update projects in EcoStruxure Machine Expert – Basic. • Upgrade the functional level of the application to version 10.2 Activate the application protection for both read and write in the project properties STEP 3: Transfer applications.