// Description
Schneider Electric Security Notification
8-Dec-20 (13-Jul-21) Document Reference Number – SEVD-2020 -343-01 (V2.0) Page 1 of 5
## EcoStruxure™ Control Expert, EcoStruxure™ Process Expert and RemoteConnect™ (V2.0)
8 December 2020 (13 July 2021)
# Overview
Schneider Electric is aware of a vulnerability in its EcoStruxure™ Control Expert product and EcoStruxure™ Process Expert.
The EcoStruxure™ Control Expert product is a software to design, diagnose, maintain and update applications for Modicon M340, M580 and M580 Safety, Momentum, Premium, and Quantum PLCs.
The EcoStruxure Process Expert DCS (formerly EcoStruxure Hybrid DCS) is a single automation system to engineer, operate, and maintain your entire infrastructure for a sustainable, productive and market-agile plant
The RemoteConnect™ product is a Windows-based application based on EcoStruxure™ Control Expert (Unity Pro) software components that provides a programming and configuration environment for the SCADAPack x70 RTU series, which is comprised of the SCADAPack 470, 474, 570, 574 and 575 Smart RTUs.
Failure to apply the mitigations provided below may risk opening a malicious file, which could result in crash of the software or unexpected code execution.
July 2021 update: Added availability of fix in the version 15.0 SP1 of EcoStruxure Control Expert
and added EcoStruxure™ Process Expert and RemoteConnect™ as impacted products.
# Affected Products and Versions
• EcoStruxure™ Control Expert prior to v15.0 SP1
• Unity Pro (former name of EcoStruxure™ Control Expert), all versions
• EcoStruxure™ Process Expert, all versions
• RemoteConnect™, all versions
## Vulnerability Details
CVE ID: CVE-2020-7560
CVSS v3.0 Base Score 8.6 | High | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H