// Description
Schneider Electric Security Notification
11-Feb-20 Document Reference Number – SEVD-2020-042-01 Page 1 of 3
## ProSoft Configurator for Modicon PMEPXM0100 (H)
11 February 2020
## Overview
Schneider Electric is aware of a vulnerability in the ProSoft Configurator for the PMEPXM0100 (H) module.
## Affected Product(s)
ProSoft Configurator v1.002 and prior, for the PMEPXM0100 (H) module.
## Vulnerability Details
CVE ID: CVE-2020-7474
CVSS v3.0 Base Score 7.3 | (High) | CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
A CWE-427: Uncontrolled Search Path Element vulnerability exists which could cause the execution of untrusted code when using double click to open a project file which may trigger execution of a malicious DLL.
## Remediation
This vulnerability is fixed in ProSoft Configurator v1.003 and is available for download below:
https://www.se.com/ww/en/download/document/PMEPXM0100_PCM/
or access the latest version in the “Software and Firmware” section using the link below:
https://www.se.com/ww/en/product/PMEPXM0100/modicon-m580-profibus-dp-master-module/
## Product Information
ProSoft Configurator for Modicon is a PC software used to configure the PMEPXM0100 (H) communication module
Product Category - Industrial Automation Control
> Learn more about Schneider Electric’s product categories here: www.schneider-electric.us/en/all-products
# Schneider Electric Security Notification
11-Feb-20 Document Reference Number – SEVD-2020-042-01 Page 2 of 3
How to determine if you are affected
Using ProSoft Configurator v1.002 and prior.
## General Security Recommendations
We strongly recommend following industry cybersecurity best practices such as:
• Locate control and safety system networks and remote devices behind firewalls, and isolate them from the business network.