SoMove

Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-07 Page 1 of 3 ## SoMove 11 August 2020 ## Overview Schneider Electric is aware of a vulnerability in the SoMove application. ## Affected Product(s) SoMove V2.8.1 and prior ## Vulnerability Details CVE ID: CVE-2020-7527 CVSS v3.0 Base Score 4.0 | Medium | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N A CWE-276: Incorrect Default Permission vulnerability exists which could cause elevation of privilege and provide full access control to local system users to SoMove component and services when a SoMove installer script is launched. ## Remediation This vulnerability is fixed in SoMove V2.8.2 and is available for download below: https://www.se.com/ww/en/download/document/SoMove_FDT/ The following mitigations and workarounds can be applied by customers to reduce the risk: • Manually update the access control permissions in the folder C:\Program Files (x86)\Schneider Electric\SoMove by providing read only permission to users. This setting will prevent everyone from overwriting file content without privileges. ## Product Information SoMove is a setup software for motor control devices, designed to configure motor control devices (Altivar, Altistart, Lexium and Tesys product lines). Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-07 Page 2 of 3 Product Category - Industrial Automation Control > Learn more about Schneider Electric’s product categories here: www.schneider-electric.us/en/all-products How to determine if you are affected SoMove V2.8.1 and prior Note: The version information can be found on SoMove application banner. ## General Security Recommendations We strongly recommend the following industry cybersecurity best practices. • Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.