EcoStruxure TM Control Expert, EcoStruxure TM Process Expert, and Modicon Controllers M580 and M340

# Schneider Electric Security Notification 9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022 -221-01 (v5.0.0) Page 1 of 6 ## EcoStruxure TM Control Expert, EcoStruxure TM Process Expert, and Modicon Controllers M580 and M340 9 August 2022 (13 August 2024) # Overview Schneider Electric is aware of a vulnerability in its EcoStruxure™ Control Expert , EcoStruxure™ Process Expert, and Modicon M580 and M340 control products. Failure to apply the remediations provided below may risk a bypass of access controls in place, which could result in the possibility of arbitrary code execution and loss of confidentiality and integrity of the project file. August 2024 Update: A remediation is available for the Modicon M580 CPU Safety (page 2). # Affected Products and Versions Product Version EcoStruxure™ Control Expert Including all Unity Pro versions (former name of EcoStruxure™ Control Expert) v15.0 SP1 and prior EcoStruxure™ Process Expert, Including all versions of EcoStruxure™ Hybrid DCS (former name of EcoStruxure™ Process Expert) Prior to v2021 Modicon M340 CPU (part numbers BMXP34*) v3.40 and prior Modicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety) v3.20 and prior Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S) Versions prior to SV4.21 # Vulnerability Details CVE ID: CVE-2022-37300 CVSS v3.1 Base Score 9.8 | Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could cause unauthorized access in read and write mode to the controller when communicating over Modbus. Schneider Electric Security Notification 9-Aug-22 (13-Aug-24) Document Reference Number – SEVD-2022 -221-01 (v5.0.0) Page 2 of 6 # Remediation Affected Product & Version Remediation EcoStruxure™ Control Expert Including all Unity Pro versions (former name of EcoStruxure™ Control Expert) Versions prior v15.1