Schneider Electric Modicon Controllers and Software (Update A)

🗓️ 13 Jul 2021 00:00:00Reported by Industrial Control Systems Cyber Emergency Response TeamType

ics

ics🔗 www.cisa.gov👁 155 Views

Schneider Electric Modicon Controllers and Software (Update A) advisory regarding vulnerabilities and update

Reporter	Title	Published	Views	Family All 55
ATTACKERKB	CVE-2021-22779	14 Jul 202100:00	–	attackerkb
Information Security Automation	Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins	19 Jul 202116:29	–	avleonov
BDU FSTEC	The vulnerability of the programming software simulator PLC EcoStruxure Control Expert, the automation system ProcessExpert, the configuration software SCADAPack RemoteConnect, and the micro-software for programmable logic controllers Modicon M580 and Modicon M340 relates to the bypassing of authentication procedures. This allows a perpetrator to gain access in read-only and write mode.	31 May 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PLC programming software EcoStruxure Control Expert, the automation system ProcessExpert, and the configuration software SCADAPack RemoteConnect lies in the insufficient protection of registration data, allowing unauthorized access by attackers to the device.	16 Aug 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerabilities of the programming software for PLCs (programmable logic controllers), the configuration software SCADAPack RemoteConnect, and the automation system for technological processes EcoStruxure Process Expert allow a intruder to gain unauthorized access to project files.	28 Mar 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the programming software for PLCs (programmable logic controllers), namely EcoStruxure Control Expert, and the automation system for technological processes, EcoStruxure Process Expert, allows a intruder to gain unauthorized access to SMTP account data.	22 May 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the PLC programming software EcoStruxure Control Expert, the automation system ProcessExpert, and the configuration software SCADAPack RemoteConnect lies in the insufficient protection of registration data, allowing unauthorized access by attackers to the device.	4 Jul 202300:00	–	bdu_fstec
Circl	CVE-2021-22778	15 Jul 202111:07	–	circl
Circl	CVE-2021-22779	15 Jul 202111:07	–	circl
Circl	CVE-2021-22780	15 Jul 202111:07	–	circl

Source	Link
raw	www.raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2021/icsa-21-194-02.json
cisa	www.cisa.gov/news-events/ics-advisories/icsa-21-194-02
us-cert	www.us-cert.cisa.gov/ncas/tips/ST04-014
us-cert	www.us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
us-cert	www.us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B

13 Jul 2021 00:00Current

8.4High risk

Vulners AI Score8.4

CVSS 26.4

CVSS 3.16.5 - 9.1

EPSS0.01014

SSVC