IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2020-252-01 — SCADAPack x70 Remote Connect and

HIGH
CVSS 7.8
Date 2026-10-16T20:41:55+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 8-Sep-20 (9-Feb-21) Document Reference Number – SEVD-2020-252-01 (V1.2) Page 1 of 4 ## SCADAPack x70 Remote Connect and ## SCADAPack x70 Security Administrator (V1.2) 8 September 2020 (9 February 2021) # Overview Schneider Electric is aware of multiple vulnerabilities in the SCADAPack x70 Remote Connect and the SCADAPack x70 Security Administrator applications. February 2021 update: Replaced CVE-2020-7528 with the pre-existing CVE-2020-12525 assigned to M&M Software, eliminating the duplicate entry for the same vulnerability. # Affected Products and Versions Affected Product & Version CVE SCADAPack x70 Remote Connect V3.6.3.574 and prior. CVE-2020-12525, CVE-2020-7529, CVE-2020-7530, CVE-2020-7531 SCADAPack x70 Security Administrator V1.2.0 and prior. CVE-2020-7532 # Vulnerability Details CVE ID: CVE-2020-12525 CVSS v3.0 Base Score 7.3 | High | CVSS:3-0:AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H M&M Software fdtCONTAINER Component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x which is included in SCADAPack x70 is vulnerable to deserialization of untrusted data in its project storage. CVE ID: CVE-2020-7529 CVSS v3.0 Base Score 5.5 | Medium | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N A CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Transversal’) vulnerability exists which allows an attacker to place content in any unprotected folder on the target system using a crafted .RCZ file. CVE ID: CVE-2020-7530 CVSS v3.0 Base Score 7.1 | High | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H A CWE-285 Improper Authorization vulnerability exists which allows improper access to executable code folders. Schneider Electric Security Notification 8-Sep-20 (9-Feb-21) Document Reference Number – SEVD-2020-252-01 (V1.2) Page 2 of 4 CVE ID: CVE-2020-7531 CVSS v3.0 Base Score 6.0 | Medium | CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:H

// Vulnerabilities (6)

CVE ID CVSS Score Severity Description
CVE-2020-7530 7.8 high
No description available.
CVE-2020-7532 7.8 high
No description available.
CVE-2020-7531 7.8 high
No description available.
CVE-2020-7529 7.8 high
No description available.
CVE-2020-12525 7.8 high
M&M Software fdtCONTAINER component in versions below 3.5.20304.x and between 3.6 and 3.6.20304.x is vulnerable to deserialization of untrusted data in its project storage. Note: This vulnerability could cause local code execution on the engineering workstation when a malicious project file is loaded into the engineering software.CVE-2020-12525 has been assigned to this vulnerability. A CVSS v3 base score of 7.3 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).
CVE-2020-7528 7.8 high
No description available.

// Affected Products (5)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Software, LLC Schneider Electric Software, LLC Modicon M340 CPU (part numbers BMXP34*) plc
L1
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC SCADAPack RemoteConnect for x70 scada_server
L2
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC Modicon M580 CPU (part numbers BMEP* and BMEH*) plc
L1
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC EcoStruxure Process Expert engineering_workstation
L3
vers:all/*
Schneider Electric Software, LLC Schneider Electric Software, LLC EcoStruxure Control Expert engineering_workstation
L3
vers:all/*

// Remediations (9)

Mitigation: Use appropriate means to protect the project storage from unauthorized manipulation.
Use appropriate means to protect the project storage from unauthorized manipulation.
Mitigation: Exchange project data only via secure exchange services.
Exchange project data only via secure exchange services.
Mitigation: The CERT@VDE advisory for M&M Software also recommends the following mitigation practices:
The CERT@VDE advisory for M&M Software also recommends the following mitigation practices:
Mitigation: Emerson has published a notification (EMR.RMT20004.Rev3) for this vulnerability in RTIS. RTIS users
Emerson has published a notification (EMR.RMT20004.Rev3) for this vulnerability in RTIS. RTIS users should review this notification for additional information specific to RTIS. CERT@VDE has published an advisory (VDE-2021-001) for this vulnerability in PEPPERL+FUCHS PACTware. CERT@VDE has published an advisory (VDE-2021-002) for this vulnerability in Weidmüller FDT/DTM Software with WI Manager. Mitsubishi Electric has published advisory 2020-020 concerning the vulnerability in MELSOFT FieldDeviceConfigurator.
Patch: Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7
Update the fdtCONTAINER component/fdtCONTAINER application to a version (fdtCONTAINER component: 3.7 or newer, fdtCONTAINER application: 4.7 or newer) that provides a secure deserialization of the project data with an updated serialization technology. This will break the compatibility to existing, non-manipulated project files.
Patch: Update the fdtCONTAINER component/fdtCONTAINER application to a version that provides a more secure
Update the fdtCONTAINER component/fdtCONTAINER application to a version that provides a more secure deserialization of the project data. This version will still use a deprecated serialization technology but will fix the currently known attack vector and will be compatible with existing, non-manipulated project files.
Mitigation: Do not open project data from an unknown source.
Do not open project data from an unknown source.
Mitigation: Reduce the user rights of the host application to the necessary minimum.
Reduce the user rights of the host application to the necessary minimum.
Mitigation: Schneider Electric provides detailed mitigation information for each of the affected products in the
Schneider Electric provides detailed mitigation information for each of the affected products in their own advisory, for more information about these issues, please refer to the original Schneider Electric publication SEVD-2021-194-01.

// References