Easergy T300 (V1.1)

Schneider Electric Security Notification 9-Jun-20 (13-May-21) Document Reference Number – SEVD-2020 -161-04 V1.1 Page 1 of 6 ## Easergy T300 (V1.1) 9 June 2020 (13 May 2021) ## Overview Researchers from Rostelecom-Solar have made Schneider Electric aware of multiple vulnerabilities affecting the company’s Easergy T300 product . Schneider Electric has worked closely with the researchers to remediate the vulnerabilities. We appreciate their collaboration and commitment to transparency. The vulnerabilities have been remediated via a free firmware update, which is available immediately by contacting Schneider Electric’s Customer Care Center . Access to the customer’s network is required for the majority of the disclosed vulnerabilities to be exploited. Therefore, if the customer’s network is well protected and monitored for intrusion, and care is taken to obtain software updates from a trusted source, the general risk of exploitation can be substantially minimized. Schneider Electric encourages customers to upgrade to the new firmware as soon as possible. The company further encourages customers to ensure any firmware files used to update the device are acquired from trusted sources; to operate the products on properly segmented control networks; to adequately secure any workstation that has been configured to have access to the product; and to follow the remediation and general security recommendations below. ## Affected Products Easergy T300 with firmware 1.5.2 and older T300 is a grid automation platform that is typically deployed to medium voltage (2400-69000 VAC) substation cabinets. ## Vulnerability Details CVE ID: CVE-2020-7503 CVSS v3.0 Base Score 8.8 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H