Harmony® eXLhoist

Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-06 Page 1 of 3 ## Harmony® eXLhoist 11 August 2020 ## Overview Schneider Electric is aware of the Bluetooth Low Energy vulnerability, known as SweynTooth, which affects the Harmony® eXLhoist product. ## Affected Product(s) Harmony® eXLhoist base stations v04.00.02.00 and prior: • ZARB12W • ZARB12H • ZARB18H • ZARB18W • ZARB18HM • ZARB18WM Note: Harmony® eXLhoist base stations compact range are not affected by this vulnerability. ## Vulnerability Details CVE ID: CVE-2019-19193 CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H The Bluetooth Low Energy peripheral implementation on Texas Instruments SIMPLELINK-CC2640R2-SDK through 3.30.00.20 and BLE-STACK through 1.5.0 before Q4 2019 for CC2640R2 and CC2540/1 devices does not properly restrict the advertisement connection request packet on reception, allowing attackers in radio range to cause a denial of service (crash) via a crafted packet. ## Remediation This vulnerability is fixed in base station V04.00.03.00 and is available for download below: https://www.se.com/fr/fr/download/document/eXLhoistFirmwareV4060/ Schneider Electric Security Notification 11-Aug-20 Document Reference Number – SEVD-2020 -224-06 Page 2 of 3 ## Product Information The Harmony® eXLhoist range of wireless remote control systems is an operator control station used in hoisting and material handling applications Product Category - Industrial Automation Control > Learn more about Schneider Electric’s product categories here: https://www.se.com/us/en/all-products How to determine if you are affected