Easergy Builder (V1.1)

Schneider Electric Security Notification 9-Jun-20 (13-May-21) Document Reference Number – SEVD-2020 -161-05 V1.1 Page 1 of 4 ## Easergy Builder (V1.1) 9 June 2020 (13 May 2021) ## Overview Researchers from Rostelecom-Solar have made Schneider Electric aware of multiple vulnerabilities affecting the company’s Easergy Builder configuration tool. Schneider Electric has worked closely with Ilya Karpov and Evgeniy Druzhinin of Rostelecom-Solar to remediate the vulnerabilities and appreciates their collaboration and commitment to transparency. The vulnerabilities have been remediated via a free software update, which is available immediately by contacting Schneider Electric’s Customer Care Center . Access to the customer’s network is required for the majority of the disclosed vulnerabilities to be exploited. Therefore, if the customer’s network is well protected and monitored for intrusion, and care is taken to obtain software updates from a trusted source, the general risk of exploitation can be substantially minimized. Schneider Electric encourages customers to upgrade to the new software as soon as possible. The company further encourages customers to ensure any firmware files used to update the device are acquired from trusted sources; to operate the products on properly segmented control networks; to adequately secure any workstation that has been configured to have access to the product; and to follow the remediation and general security recommendations below. ## Affected Products Easergy Builder version 1.4.7.2 and older Easergy Builder is used by expert engineering teams to configure the T300 grid automation platform. ## Vulnerability Details CVE ID: CVE-2020-7514 CVSS v3.0 Base Score 8.4 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H