Modicon M258 Logic Controllers and SoMachine/ SoMachine Motion Software

Schneider Electric Security Notification 8-Dec-20 Document Reference Number – SEVD-2020 -343-09 Page 1 of 4 # Modicon M258 Logic Controllers and SoMachine/ SoMachine Motion Software 8 December 2020 # Overview Schneider Electric is aware of a vulnerability in its M258 Logic Controllers and SoMachine/ SoMachine Motion software. The M258 Logic Controllers and SoMachine/SoMachine Motion software are Programmable Logic Controllers and the associated programming software. Failure to apply the remediations provided below may risk buffer overflow attack, which could result in arbitrary code execution or unavailability of the process or operations. # Affected Products and Versions Product Version Modicon M258 Firmware All versions prior to V5.0.4.11 SoMachine/SoMachine Motion software All versions # Vulnerability Details CVE ID: CVE-2020-28220 CVSS v3.0 Base Score 4.3 | Medium | CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a buffer overflow when the length of a file transferred to the webserver is not verified. # Remediation Version 5.0.4.11 of the Modicon M258 Logic Controller and the new software version of SoMachine/SoMachine Motion (now called EcoStruxure Machine Expert) no longer exhibit this problem. We recommend customers migrate from the legacy SoMachine/SoMachine Motion software to the new version called EcoStruxure Machine Expert (available here https://www.se.com/ww/en/product-range-download/2226-ecostruxure-machine-expert/ -/software-firmware-tab ). Then, update the Modicon M258 Logic Controller firmware to the latest Schneider Electric Security Notification 8-Dec-20 Document Reference Number – SEVD-2020 -343-09 Page 2 of 4 version through Schneider Electric Software Update (SESU). Note: a reboot of the controller is required.