{
  "CVSS 2.0": "AV:N/AC:L/Au:S/C:N/I:C/A:N",
  "CVSS 3.0": "AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Schneider Electric",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (Modicon M241), - (Modicon M251), - (Modicon M258), - (Modicon LMC058), - (PacDrive 3 Controllers LMC Eco), - (PacDrive 3 Controllers Pro), - (PacDrive 3 Controllers Pro2), - (PacDrive Controller LMC078), - (Modicon M262), - (HMISCU)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0432 \u043f\u043e\u0440\u0442\u0430\u043c UDP/1740, TCP/11740 \u0438 TCP/1105;\n- \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \"Implicit Checks\";\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0442\u0438\u043f \u0434\u0430\u043d\u043d\u044b\u0445 POINTER; \n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0438\u043d\u0441\u0442\u0440\u0443\u043a\u0446\u0438\u0438 MEMMOVE;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u043c\u0435\u0436\u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0434\u043b\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0445 \u0447\u0430\u0441\u0442\u043d\u044b\u0445 \u0441\u0435\u0442\u0435\u0439 \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 (VPN);\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0437\u0430\u0448\u0438\u0444\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u043a\u0430\u043d\u0430\u043b\u043e\u0432 \u0441\u0432\u044f\u0437\u0438;\n\n\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439:\nhttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-01.pdf",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "11.04.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "24.05.2023",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "24.05.2023",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2023-02779",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2023-28355",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u044b",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Modicon M241, Modicon M251, Modicon M258, Modicon LMC058, PacDrive 3 Controllers LMC Eco, PacDrive 3 Controllers Pro, PacDrive 3 Controllers Pro2, PacDrive Controller LMC078, Modicon M262, HMISCU",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Codesys \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b Schneider Electric, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0438 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u0438 (CWE-354)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u0430 \u043f\u0440\u043e\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u043e\u0439 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0430\u0446\u0438\u0438 Codesys \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0433\u043e \u0432 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u0438\u0440\u0443\u0435\u043c\u044b\u0435 \u043b\u043e\u0433\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b Schneider Electric, \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u0432 \u043e\u0448\u0438\u0431\u043e\u0447\u043d\u043e\u0439 \u043e\u0431\u043b\u0430\u0441\u0442\u0438 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u043e\u043a\u0430\u0437\u0430\u0442\u044c \u0432\u043e\u0437\u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u043d\u0430 \u0446\u0435\u043b\u043e\u0441\u0442\u043d\u043e\u0441\u0442\u044c \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041d\u0435\u0441\u0430\u043d\u043a\u0446\u0438\u043e\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 \u0441\u0431\u043e\u0440 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-01.pdf",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0435 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e \u0410\u0421\u0423 \u0422\u041f, \u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-354",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,8)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,7)"
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "We strongly recommend the following industry cybersecurity best practices.\n\nhttps://www.se.com/us/en/download/document/7EN52-0390/\n* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.\n* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.\n* Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode.\n* Never connect programming software to any network other than the network intended for that device.\n* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.\n* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.\n* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.\n* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nFor more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document. \n",
        "title": "General Security Recommendations"
      },
      {
        "category": "general",
        "text": "The severity of vulnerabilities was calculated using the CVSS Base metrics in version 3.1 (CVSS v3.1) without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer\u2019s environment",
        "title": "Note regarding vulnerability details"
      },
      {
        "category": "general",
        "text": "This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.\nFor further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp",
        "title": "For More Information"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION",
        "title": "LEGAL DISCLAIMER"
      },
      {
        "category": "general",
        "text": "At Schneider, we believe access to energy and digital is a basic human right. We empower all to do more with less, ensuring Life Is On everywhere, for everyone, at every moment.\n\nWe provide energy and automation digital solutions for efficiency and sustainability. We combine world-leading energy technologies, real-time automation, software and services into integrated solutions for Homes, Buildings, Data Centers, Infrastructure and Industries.\n\nWe are committed to unleash the infinite possibilities of an open, global, innovative community that is passionate with our Meaningful Purpose, Inclusive and Empowered values.\n\nwww.se.com ",
        "title": "About Schneider Electric"
      },
      {
        "category": "summary",
        "text": "Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS Runtime. Many\nvendors, including Schneider Electric, embed CODESYS in their offers. If successfully\nexploited, these vulnerabilities could result in a denial of service or, in some cases, in remote\ncode execution on PacDrive controllers, Modicon Controllers M241 / M251 / M262 / M258 /\nLMC058 / M218 and HMISCU products.\nFailure to apply the mitigations provided below may risk Logic Integrity and Permissions attacks,\nwhich could result in loss of controllers\u2019 integrity.\nJanuary 2024 Update: A remediation is available for CVE-2022-4224 for Harmony HMISCU\nController, Modicon Controllers M241 / M251 / M262 and PacDrive Controllers LMC\nEco/Pro/Pro2.",
        "title": "Overview"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "cybersecurity@se.com",
      "name": "Schneider Electric CPCERT",
      "namespace": "https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp"
    },
    "references": [
      {
        "category": "self",
        "summary": "CODESYS Runtime Vulnerabilit - SEVD-2023-101-01 PDF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-01.pdf"
      },
      {
        "category": "self",
        "summary": "CODESYS Runtime Vulnerabilit - SEVD-2023-101-01 CSAF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2023-101-01.json"
      },
      {
        "category": "self",
        "summary": "Recommended Cybersecurity Best Practices",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=7EN52-0390\u0026p_enDocType=White+Paper\u0026p_File_Name=Cybersecurity_Best+Practices_EN.pdf"
      }
    ],
    "title": "CODESYS Runtime Vulnerabilities",
    "tracking": {
      "current_release_date": "2024-01-09T13:31:00.000Z",
      "generator": {
        "date": "2024-01-05T16:04:06.783Z",
        "engine": {
          "name": "Schneider Electric CSAF Generator",
          "version": "1.1"
        }
      },
      "id": "SEVD-2023-101-01",
      "initial_release_date": "2023-04-11T13:31:49.000Z",
      "revision_history": [
        {
          "date": "2023-04-11T13:31:49.000Z",
          "number": "1.0.0",
          "summary": "Original Release"
        },
        {
          "date": "2023-04-19T13:31:49.000Z",
          "number": "1.1.0",
          "summary": "Updated acknowledgement section"
        },
        {
          "date": "2024-01-09T06:30:00.000Z",
          "number": "2.0.0",
          "summary": "A remediation is now available for CVE-2022-4224\nfor Harmony HMISCU Controller HMISCU,\nModicon Controllers M241 / M251 / M262 and\nPacDrive Controllers LMC Eco/Pro/Pro2."
        }
      ],
      "status": "final",
      "version": "2.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2 All Versions",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "PacDrive 3 Controllers: LMC Eco/Pro/Pro2"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric PacDrive Controller LMC078 All Versions",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "PacDrive Controller LMC078"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M241 All Versions",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M241"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M251 All Versions",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M251"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M262 All Versions",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M262"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M258 All Versions",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M258"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller LMC058 All Versions",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller LMC058"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M218 All Versions",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M218"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric HMISCU Controller All Versions",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "HMISCU Controller"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Reid Wightman"
          ],
          "organization": "Dragos Inc."
        }
      ],
      "cve": "CVE-2022-4224",
      "cwe": {
        "id": "CWE-668",
        "name": "Exposure of Resource to Wrong Sphere"
      },
      "notes": [
        {
          "category": "description",
          "text": "A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause inappropriate access to Sensitive System Files when user management is not configured.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Schneider Electric is establishing a remediation plan for all future versions that will include a fix for these vulnerabilities. We will update this document when the remediations are available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploitation.\r\n\u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneider-electric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242 \r\n\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.\r\n\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications.\r\n\u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs.\r\n\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\r\n\u2022 Use firewalls to protect and separate the control system network from other networks.\r\n\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required.\r\n\u2022 Activate and apply user management and password features.\r\n\u2022 Use encrypted communication links.\r\n\u2022 Limit the access to both development and control system by physical means, operating system features, etc.\r\n\u2022 Protect both development and control system by using up to date malware protection.\r\nTo ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here:\r\nhttps://www.se.com/en/work/support/cybersecurity/security-notifications.jsp\r\n",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://download.schneider-electric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242"
        },
        {
          "category": "vendor_fix",
          "date": "2024-01-09T06:30:00.000Z",
          "details": "Harmony HMISCU Controller Firmware delivered\nwith Vijeo Designer v6.3.1 includes a fix for CVE-\n2022-4224 vulnerability and can be updated through\nthe Schneider Electric Software Update (SESU)\napplication.\nhttps://www.se.com/ww/en/product-range/1054-\nvijeo-designer-hmi-software/#software-and-firmware\nOn the engineering workstation, update to v6.3.1 of\nVijeo Designer.\nIn order to complete the update, connect to Harmony\nHMI and download the project file using Vijeo\nDesigner v6.3.1.",
          "product_ids": [
            "9"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/ww/en/product-country-selector/?pageType=product-range\u0026sourceId=1054#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "date": "2024-01-09T06:30:00.000Z",
          "details": "Modicon Controller M241 Firmware delivered with\nMachine Expert v2.2 includes a fix for CVE-2022-\n4224 vulnerability and can be updated through the\nSchneider Electric Software Update (SESU)\napplication.\nhttps://www.se.com/ww/en/product-range/2226-\necostruxure-machine-expert-software/\nOn the engineering workstation, update to v2.2 of\nMachine Expert.\nUpdate Modicon Controller M241 to the latest\nFirmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/ww/en/product-country-selector/?pageType=product-range\u0026sourceId=2226"
        },
        {
          "category": "vendor_fix",
          "date": "2024-01-09T06:30:00.000Z",
          "details": "Modicon Controller M251 Firmware delivered with\nMachine Expert v2.2 includes a fix for CVE-2022-\n4224 vulnerability and can be updated through the\nSchneider Electric Software Update (SESU)\napplication.\nhttps://www.se.com/ww/en/product-range/2226-\necostruxure-machine-expert-software/\nOn the engineering workstation, update to v2.2 of\nMachine Expert.\nUpdate Modicon Controller M251 to the latest\nFirmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/ww/en/product-country-selector/?pageType=product-range\u0026sourceId=2226"
        },
        {
          "category": "vendor_fix",
          "date": "2024-01-09T06:30:00.000Z",
          "details": "Modicon Controller M262 Firmware delivered with\nMachine Expert v2.2 includes a fix for CVE-2022-\n4224 vulnerability and can be updated through the\nSchneider Electric Software Update (SESU)\napplication.\nhttps://www.se.com/ww/en/product-range/2226-\necostruxure-machine-expert-software/\nOn the engineering workstation, update to V2.2 of\nMachine Expert.\nUpdate Modicon Controller M262 to the latest\nFirmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/ww/en/product-country-selector/?pageType=product-range\u0026sourceId=2226"
        },
        {
          "category": "vendor_fix",
          "date": "2024-01-09T06:30:00.000Z",
          "details": "PacDrive3 Controllers LMC Eco/Pro/Pro2 Firmware\ndelivered with Machine Expert v2.2 includes a fix for\nCVE-2022-4224 vulnerability and can be updated\nthrough the Schneider Electric Software Update\n(SESU) application.\nhttps://www.se.com/ww/en/product-range/2226-\necostruxure-machine-expert-software/\nOn the engineering workstation, update to v2.2 of\nMachine Expert.\nUpdate PacDrive 3 Controllers LMC Eco/Pro/Pro2 to\nthe latest Firmware and preform reboot.",
          "product_ids": [
            "1"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://www.se.com/ww/en/product-country-selector/?pageType=product-range\u0026sourceId=2226"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "title": "CVE-2022-4224"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Reid Wightman"
          ],
          "organization": "Dragos Inc."
        }
      ],
      "cve": "CVE-2023-28355",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper Validation of Integrity Check Value vulnerability exists that could cause loss of view, modification of view, loss of control, and denial of control when Integrity check fails to identify out-of-band logic changes.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Schneider Electric is establishing a remediation plan for all future versions that will include a fix for these vulnerabilities. We will update this document when the remediations are available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploitation.\r\n\u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneider-electric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242 \r\n\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.\r\n\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications.\r\n\u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs.\r\n\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\r\n\u2022 Use firewalls to protect and separate the control system network from other networks.\r\n\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required.\r\n\u2022 Activate and apply user management and password features.\r\n\u2022 Use encrypted communication links.\r\n\u2022 Limit the access to both development and control system by physical means, operating system features, etc.\r\n\u2022 Protect both development and control system by using up to date malware protection.\r\nTo ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here:\r\nhttps://www.se.com/en/work/support/cybersecurity/security-notifications.jsp\r\n",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://download.schneider-electric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "title": "CVE-2023-28355"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Reid Wightman"
          ],
          "organization": "Dragos Inc."
        }
      ],
      "cve": "CVE-2022-4046",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause loss of view, modification of view, loss of control, and denial of control when Integrity check fails to identify out-of-band logic changes.",
          "title": "CVE Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "Schneider Electric is establishing a remediation plan for all future versions that will include a fix for these vulnerabilities. We will update this document when the remediations are available. Until then, customers should immediately apply the following mitigations to reduce the risk of exploitation.\r\n\u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneider-electric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242 \r\n\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.\r\n\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications.\r\n\u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs.\r\n\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\r\n\u2022 Use firewalls to protect and separate the control system network from other networks.\r\n\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required.\r\n\u2022 Activate and apply user management and password features.\r\n\u2022 Use encrypted communication links.\r\n\u2022 Limit the access to both development and control system by physical means, operating system features, etc.\r\n\u2022 Protect both development and control system by using up to date malware protection.\r\nTo ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here:\r\nhttps://www.se.com/en/work/support/cybersecurity/security-notifications.jsp\r\n",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://download.schneider-electric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        }
      ],
      "title": "CVE-2022-4046"
    }
  ]
}

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "We strongly recommend the following industry cybersecurity best practices.\n\nhttps://www.se.com/us/en/download/document/7EN52-0390/\n* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.\n* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.\n* Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode.\n* Never connect programming software to any network other than the network intended for that device.\n* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.\n* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.\n* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.\n* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nFor more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document. \n",
        "title": "General Security Recommendations"
      },
      {
        "category": "general",
        "text": "This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.\nFor further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp",
        "title": "For More Information"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION",
        "title": "LEGAL DISCLAIMER"
      },
      {
        "category": "general",
        "text": "Schneider\u2019s purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and\r\nsustainability for all. We call this Life Is On.\n\nOur mission is to be the trusted partner in Sustainability and Efficiency.\n\nWe are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart\r\nindustries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep\r\ndomain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,\r\nsoftware and services, delivering digital twins to enable profitable growth for our customers.\n\nWe are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries\r\nto ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our\r\nmeaningful purpose of a sustainable future for all.",
        "title": "About Schneider Electric"
      },
      {
        "category": "summary",
        "text": "Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS runtime system V3 communication server. Many vendors, including Schneider Electric, embed CODESYS in their offers. \r\n\r\nIf successfully exploited, these vulnerabilities could result in a denial of service or, in some cases, in remote code execution on PacDrive controllers, Modicon Controllers M241 / M251 / M262 / M258 / LMC058 / LMC078 / M218 ,  HMISCU, the Simulation Runtime SoftSPS from EcoStruxure Machine Expert and EcoStruxure Microgrid Operation products. \r\n\r\nFailure to apply the mitigations provided below may result in denial of service and/or arbitrary remote code execution.  ",
        "title": "Overview"
      },
      {
        "category": "details",
        "text": "Vulnerabilities disclosed by CODESYSTM group in the CODESYS Runtime and Simulation Runtime impact Schneider Electric controller products and software. \n\nAdditional information about the vulnerabilities can be found in the CODESYSTM Advisories at: \n Advisory 2023-02 \u2022 Advisory 2023-03\n \u2022 Advisory 2023-04\n \u2022 Advisory 2023-05\n \u2022 Advisory 2023-06\n \u2022 Advisory 2023-07\n \u2022 Advisory 2023-08 \n \u2022 Advisory 2023-09 ",
        "title": "Details"
      },
      {
        "category": "other",
        "text": "Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric\u2019s Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp if you need assistance removing a patch. "
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "cpcert@se.com",
      "name": "Schneider Electric CPCERT",
      "namespace": "https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp"
    },
    "references": [
      {
        "category": "self",
        "summary": "CODESYS Runtime Vulnerabilities - SEVD-2023-192-04 PDF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-192-04.pdf"
      },
      {
        "category": "self",
        "summary": "CODESYS Runtime Vulnerabilities - SEVD-2023-192-04 CSAF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2023-192-04.json"
      },
      {
        "category": "external",
        "summary": "Recommended Cybersecurity Best Practices",
        "url": "https://www.se.com/us/en/download/document/7EN52-0390/"
      }
    ],
    "title": "CODESYS Runtime Vulnerabilities",
    "tracking": {
      "current_release_date": "2025-12-09T08:00:00.000Z",
      "generator": {
        "date": "2025-12-05T07:00:00.000Z",
        "engine": {
          "name": "Schneider Electric CSAF Generator",
          "version": "1.2"
        }
      },
      "id": "SEVD-2023-192-04",
      "initial_release_date": "2023-07-11T07:15:18.000Z",
      "revision_history": [
        {
          "date": "2023-07-11T07:15:18.000Z",
          "number": "1.0.0",
          "summary": "Original Release"
        },
        {
          "date": "2023-08-08T15:41:00.000Z",
          "number": "2.0.0",
          "summary": "New CODESYS advisories 2023-04 to 2023-09 added. Additional impacted product: Harmony and Easy Harmony, Vijeo Designer embedded in EcoStruxure\u2122 Machine Expert."
        },
        {
          "date": "2024-01-09T00:00:00.000Z",
          "number": "3.0.0",
          "summary": "Remediations added for different products."
        },
        {
          "date": "2024-03-12T00:00:00.000Z",
          "number": "4.0.0",
          "summary": "A remediation is now available for HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series"
        },
        {
          "date": "2024-04-09T00:00:00.000Z",
          "number": "5.0.0",
          "summary": "A remediation is now available for Easy Harmony HMIET6/HMIFT6, and Magelis HMIGXU series"
        },
        {
          "date": "2024-06-11T00:00:00.000Z",
          "number": "6.0.0",
          "summary": "Easy Modicon M310 is added to the list of products impacted"
        },
        {
          "date": "2025-08-12T04:00:00.000Z",
          "number": "7.0.0",
          "summary": "Remediations are available for Harmony iPC series and Harmony P6 series with Vijeo Designer."
        },
        {
          "date": "2025-11-11T08:00:00.000Z",
          "number": "8.0.0",
          "summary": "Remediation is available for Easy Modicon M310."
        },
        {
          "date": "2025-12-09T08:00:00.000Z",
          "number": "8.1.0",
          "summary": "Replaced advisory IDs with CVE IDs. Added vulnerability details, including CVE descriptions, CWE identifiers, CVSS scores, and vector strings. Corrected mappings of affected and fixed products for each CVE."
        }
      ],
      "status": "final",
      "version": "8.1.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3.1",
                "product": {
                  "name": "Schneider Electric HMISCU Controller All versions prior to v6.3.1",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "HMISCU Controller"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller LMC078 All Versions",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller LMC078"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M241 All versions prior to v5.2.11.18",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M241"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M251 All Versions prior to v5.2.11.18",
                  "product_id": "4"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M251"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.2.8.12",
                "product": {
                  "name": "Schneider Electric Modicon Controller M262 All versions prior to v5.2.8.12",
                  "product_id": "5"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M262"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M258 All Versions",
                  "product_id": "6"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M258"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller LMC058 All Versions",
                  "product_id": "7"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller LMC058"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M218 All Versions",
                  "product_id": "8"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M218"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.76.14.1",
                "product": {
                  "name": "Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2  All versions prior to v1.76.14.1",
                  "product_id": "9"
                }
              }
            ],
            "category": "product_name",
            "name": "PacDrive 3 Controllers: LMC Eco/Pro/Pro2 "
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.2",
                "product": {
                  "name": "Schneider Electric SoftSPS embedded in EcoStruxure\u2122 Machine Expert  All Versions prior to Machine Expert v2.2",
                  "product_id": "10"
                }
              }
            ],
            "category": "product_name",
            "name": "SoftSPS embedded in EcoStruxure\u2122 Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3.1",
                "product": {
                  "name": "Schneider Electric Vijeo Designer embedded in EcoStruxure\u2122 Machine Expert  All versions prior to v6.3.1",
                  "product_id": "12"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer embedded in EcoStruxure\u2122 Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3 HF3",
                "product": {
                  "name": "Schneider Electric Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series All Versions prior to  V6.3 HF3",
                  "product_id": "13"
                }
              }
            ],
            "category": "product_name",
            "name": "Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.0 HF2",
                "product": {
                  "name": "Schneider Electric Easy Harmony HMIET6/HMIFT6 Magelis HMIGXU all versions prior to v2.0 HF2",
                  "product_id": "14"
                }
              }
            ],
            "category": "product_name",
            "name": "Easy Harmony HMIET6/HMIFT6 Magelis HMIGXU series"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3.1",
                "product": {
                  "name": "Schneider Electric HMISCU Controller 6.3.1",
                  "product_id": "15"
                }
              }
            ],
            "category": "product_name",
            "name": "HMISCU Controller"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M241 5.2.11.18",
                  "product_id": "16"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M241"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M251 5.2.11.18",
                  "product_id": "17"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M251"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "5.2.8.12",
                "product": {
                  "name": "Schneider Electric Modicon Controller M262 5.2.8.12",
                  "product_id": "18"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M262"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.76.14.1",
                "product": {
                  "name": "Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2  1.76.14.1",
                  "product_id": "19"
                }
              }
            ],
            "category": "product_name",
            "name": "PacDrive 3 Controllers: LMC Eco/Pro/Pro2 "
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.2",
                "product": {
                  "name": "Schneider Electric SoftSPS embedded in EcoStruxure\u2122 Machine Expert 2.2",
                  "product_id": "20"
                }
              }
            ],
            "category": "product_name",
            "name": "SoftSPS embedded in EcoStruxure\u2122 Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3.1",
                "product": {
                  "name": "Schneider Electric Vijeo Designer embedded in EcoStruxure\u2122 Machine Expert  6.3.1",
                  "product_id": "21"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer embedded in EcoStruxure\u2122 Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3 HF3",
                "product": {
                  "name": "Schneider Electric Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series iPC series with Vijeo Designer runtime V6.3 HF3",
                  "product_id": "22"
                }
              }
            ],
            "category": "product_name",
            "name": "Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series iPC series with Vijeo Designer runtime"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0 HotFix 2",
                "product": {
                  "name": "Vijeo Designer Basic v2.0 HF2",
                  "product_id": "23"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer Basic"
          },
          {
            "category": "product_name",
            "name": "Harmony iPC series",
            "product": {
              "name": "Schneider Electric Harmony iPC series",
              "product_id": "24"
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Magelis XBT series All Versions",
                  "product_id": "25"
                }
              }
            ],
            "category": "product_name",
            "name": "Magelis XBT series"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.1.5.82",
                "product": {
                  "name": "Schneider Electric Easy Modicon M310 All versions prior to v3.1.5.82",
                  "product_id": "26"
                }
              }
            ],
            "category": "product_name",
            "name": "Easy Modicon M310"
          },
          {
            "category": "product_name",
            "name": "Harmony P6 series",
            "product": {
              "name": "Schneider Electric Harmony P6 series",
              "product_id": "27"
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3 SP2",
                "product": {
                  "name": "Schneider Electric Vijeo Designer runtime \u003c6.3 SP2",
                  "product_id": "28"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer runtime"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3 SP2",
                "product": {
                  "name": "Schneider Electric Vijeo Designer runtime 6.3 SP2",
                  "product_id": "29"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer runtime"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "3.1.5.82",
                "product": {
                  "name": "Schneider Electric Easy Modicon M310 version v3.1.5.82",
                  "product_id": "34"
                }
              }
            ],
            "category": "product_name",
            "name": "Easy Modicon M310"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony iPC series",
          "product_id": "30"
        },
        "product_reference": "28",
        "relates_to_product_reference": "24"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Version 6.3 SP2 installed on Schneider Electric Harmony iPC series",
          "product_id": "31"
        },
        "product_reference": "29",
        "relates_to_product_reference": "24"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony P6 series",
          "product_id": "32"
        },
        "product_reference": "28",
        "relates_to_product_reference": "27"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Version 6.3 SP2 installed on Schneider Electric Harmony P6 series",
          "product_id": "33"
        },
        "product_reference": "29",
        "relates_to_product_reference": "27"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4046",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "In addition to the functionality described above, there are memory access functions that allow the PLC application code to read or write memory. These are not limited to the data memories that are assigned to it or allocated by it. For this reason, the PLC application code can potentially access the entire RAM memory of the CODESYS Control runtime process surrounding it. This could allow PLC programmers who have successfully authenticated themselves at the controller to execute PLC application code that can modify itself or read or write sensitive data of the CODESYS Control runtime process.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u00b4s Modicon LMC078 controllers have reached end of their life and are no longer commercially available. They have been replaced by the Modicon M262 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Modicon M218 controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon Easy M200 and Modicon M241 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-4046"
    },
    {
      "cve": "CVE-2023-28355",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "The PLC application code executed by the CODESYS Control Runtime contains a checksum. This enables the CODESYS development system to check at login whether its loaded project matches the PLC application code executed on the controller. This checksum is not sufficient to reliably detect PLC application code that has been modified in memory or boot application files that have been manipulated.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4",
          "5",
          "6",
          "7",
          "8",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u00b4s Modicon LMC078 controllers have reached end of their life and are no longer commercially available. They have been replaced by the Modicon M262 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "2"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Modicon M218 controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon Easy M200 and Modicon M241 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "8"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4",
            "5",
            "6",
            "7",
            "8",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-28355"
    },
    {
      "cve": "CVE-2022-47378",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests with inconsistent content can cause the CmpFiletransfer component to read internally from an invalid address, potentially leading to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47378"
    },
    {
      "cve": "CVE-2022-47379",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpApp component to write attacker-controlled data to memory, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47379"
    },
    {
      "cve": "CVE-2022-47380",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpApp component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47380"
    },
    {
      "cve": "CVE-2022-47381",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpApp component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47381"
    },
    {
      "cve": "CVE-2022-47382",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47382"
    },
    {
      "cve": "CVE-2022-47383",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47383"
    },
    {
      "cve": "CVE-2022-47384",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47384"
    },
    {
      "cve": "CVE-2022-47386",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47386"
    },
    {
      "cve": "CVE-2022-47387",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47387"
    },
    {
      "cve": "CVE-2022-47388",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47388"
    },
    {
      "cve": "CVE-2022-47389",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47389"
    },
    {
      "cve": "CVE-2022-47390",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47390"
    },
    {
      "cve": "CVE-2022-47385",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpAppForce component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47385"
    },
    {
      "cve": "CVE-2022-47392",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests with inconsistent content can cause the CmpApp/CmpAppBP/CmpAppForce components to read internally from an invalid address, potentially leading to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47392"
    },
    {
      "cve": "CVE-2022-47393",
      "cwe": {
        "id": "CWE-822",
        "name": "Untrusted Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpFiletransfer component to dereference addresses provided by the request for internal read access, which can lead to a denial-of-service situation.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47393"
    },
    {
      "cve": "CVE-2022-47391",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "notes": [
        {
          "category": "description",
          "text": "Crafted communication requests can cause the affected products to read internally from an invalid address, potentially leading to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2022-47391"
    },
    {
      "cve": "CVE-2023-37545",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37545"
    },
    {
      "cve": "CVE-2023-37546",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37546"
    },
    {
      "cve": "CVE-2023-37547",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37547"
    },
    {
      "cve": "CVE-2023-37548",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37548"
    },
    {
      "cve": "CVE-2023-37549",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37549"
    },
    {
      "cve": "CVE-2023-37550",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37550"
    },
    {
      "cve": "CVE-2023-37551",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specially crafted communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37551"
    },
    {
      "cve": "CVE-2023-37552",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37552"
    },
    {
      "cve": "CVE-2023-37553",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37553"
    },
    {
      "cve": "CVE-2023-37554",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37554"
    },
    {
      "cve": "CVE-2023-37555",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37555"
    },
    {
      "cve": "CVE-2023-37556",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37556"
    },
    {
      "cve": "CVE-2023-37557",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37557"
    },
    {
      "cve": "CVE-2023-37558",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37558"
    },
    {
      "cve": "CVE-2023-37559",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-37559"
    },
    {
      "cve": "CVE-2023-3662",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "description",
          "text": "The CODESYS Development System is vulnerable to the execution of malicious binaries from the current working directory.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-3662"
    },
    {
      "cve": "CVE-2023-3663",
      "cwe": {
        "id": "CWE-924",
        "name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
      },
      "notes": [
        {
          "category": "description",
          "text": "The Notification Center of the CODESYS Development System receives messages without ensuring that the message was not modified during transmission. This finally enables MITMs code execution when the user clicks the Learn More button.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-3663"
    },
    {
      "cve": "CVE-2023-3669",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "description",
          "text": "The Notification Center of the CODESYS Development System receives messages without ensuring that the message was not modified during transmission. This finally enables MITMs code execution when the user clicks the Learn More button.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-3669"
    },
    {
      "cve": "CVE-2023-3670",
      "cwe": {
        "id": "CWE-668",
        "name": "Exposure of Resource to Wrong Sphere"
      },
      "notes": [
        {
          "category": "description",
          "text": "CODESYS Scripting executes potentially malicious scripts saved by another user.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "15",
          "16",
          "17",
          "18",
          "19",
          "20",
          "21",
          "22",
          "23",
          "31",
          "33",
          "34"
        ],
        "known_affected": [
          "1",
          "3",
          "4",
          "5",
          "6",
          "7",
          "9",
          "10",
          "12",
          "13",
          "14",
          "25",
          "26",
          "30",
          "32"
        ]
      },
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "1"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "3"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "4"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "5"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "25"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "9"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "12"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "10"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "10"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "26"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "13"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "14"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "30",
            "32"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "26"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "1",
            "3",
            "4",
            "5",
            "6",
            "7",
            "9",
            "10",
            "12",
            "13",
            "14",
            "25",
            "26",
            "30",
            "32"
          ]
        }
      ],
      "title": "CVE-2023-3670"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Easergy Studio versions ant\u00e9rieures \u00e0 v9.3.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Magelis XBT",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M580 versions ant\u00e9rieures \u00e0 sv4.20",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Control Expert versions ant\u00e9rieures \u00e0 v16.0",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Harmony/Magelis HMISCU versions ant\u00e9rieures \u00e0 6.3.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "contr\u00f4leurs PacDrive sans le dernier correctif de s\u00e9curit\u00e9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PowerLogic T300, MiCOM C264 D7.21 (et ult\u00e9rieures) ou Easergy C5 1.1.6 (et ult\u00e9rieures), PACiS GTW et EPAS GTW sans les derni\u00e8res mesures de contournement",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "contr\u00f4leurs Modicon M241, M251 et M262, HMISCU et EcoStruxure Machine Expert sans les derniers correctifs de s\u00e9curit\u00e9 et mesures de contournement",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-4046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
    },
    {
      "name": "CVE-2023-7032",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-7032"
    },
    {
      "name": "CVE-2023-27976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27976"
    },
    {
      "name": "CVE-2023-1548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1548"
    },
    {
      "name": "CVE-2020-25176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25176"
    },
    {
      "name": "CVE-2020-25178",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25178"
    },
    {
      "name": "CVE-2023-28355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28355"
    },
    {
      "name": "CVE-2022-4224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4224"
    },
    {
      "name": "CVE-2020-25180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25180"
    },
    {
      "name": "CVE-2019-6833",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-6833"
    },
    {
      "name": "CVE-2020-25184",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25184"
    },
    {
      "name": "CVE-2020-25182",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-25182"
    }
  ],
  "initial_release_date": "2024-01-09T00:00:00",
  "last_revision_date": "2024-01-09T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0013",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-01-09T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2019-225-01 du 13 ao\u00fbt 2019",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2019-225-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2019-225-01.json"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-009-02 du 09 janvier 2024",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-009-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-009-02.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-03 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-03.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-06 du 10 janvier 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-01 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-01.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-192-04 du 11 juillet 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-192-04.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-159-04 du 10 janvier 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-159-04_ISaGRAF_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-159-04 du 08 juin 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-159-04_ISaGRAF_Security_Notification.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "EcoStruxure\u2122 Process Expert toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Harmony et Easy Harmony, Vijeo Designer embarqu\u00e9 dans EcoStruxure\u2122 Machine Expert toutes versions",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "GP-Pro EX WinGP pour iPC et PC/AT versions ant\u00e9rieures \u00e0 4.09.500",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-37549",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37549"
    },
    {
      "name": "CVE-2023-3953",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3953"
    },
    {
      "name": "CVE-2023-37550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37550"
    },
    {
      "name": "CVE-2023-37556",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37556"
    },
    {
      "name": "CVE-2022-4046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
    },
    {
      "name": "CVE-2023-37558",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37558"
    },
    {
      "name": "CVE-2023-3662",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3662"
    },
    {
      "name": "CVE-2023-37559",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37559"
    },
    {
      "name": "CVE-2023-37548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37548"
    },
    {
      "name": "CVE-2023-37545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37545"
    },
    {
      "name": "CVE-2023-37557",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37557"
    },
    {
      "name": "CVE-2023-37555",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37555"
    },
    {
      "name": "CVE-2023-28355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28355"
    },
    {
      "name": "CVE-2023-3670",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3670"
    },
    {
      "name": "CVE-2023-37553",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37553"
    },
    {
      "name": "CVE-2023-3669",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3669"
    },
    {
      "name": "CVE-2022-45789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45789"
    },
    {
      "name": "CVE-2023-37554",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37554"
    },
    {
      "name": "CVE-2022-45788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45788"
    },
    {
      "name": "CVE-2023-37552",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37552"
    },
    {
      "name": "CVE-2023-37551",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37551"
    },
    {
      "name": "CVE-2023-37546",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37546"
    },
    {
      "name": "CVE-2023-37547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-37547"
    },
    {
      "name": "CVE-2023-3663",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-3663"
    }
  ],
  "initial_release_date": "2023-08-08T00:00:00",
  "last_revision_date": "2023-08-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0632",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-08-08T00:00:00.000000"
    },
    {
      "description": "Ajoout des vuln\u00e9rabilit\u00e9s list\u00e9es par CODESYS.",
      "revision_date": "2023-08-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-192-04 du 8 ao\u00fbt 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-192-04.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-06 du 8 ao\u00fbt 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-06_Modicon_Controllers_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-05 du 8 ao\u00fbt 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-220-01 du 8 ao\u00fbt 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-220-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-220-01.pdf"
    }
  ]
}

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Modicon M580 NOC Control (BMENOC0321) versions ant\u00e9rieures \u00e0 1.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PacDrive 3 Controllers LMC",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easergy Builder installer versions ant\u00e9rieures \u00e0 V1.7.24",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Controller LMC058",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Controller M258",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Eco/Pro/Pro2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M580 versions ant\u00e9rieures \u00e0 SV4.10",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Modicon M340 CPU (part numbers BMXP34*) versions ant\u00e9rieures \u00e0 SV3.51",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Controller M262",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "PacDrive Controller LMC078",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Controller M241",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "InsightHome, InsightFacility et Conext Gateway versions ant\u00e9rieures \u00e0 1.17 Build 079",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "EcoStruxure Control Expert versions ant\u00e9rieures \u00e0 V15.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Schneider Electric Easy UPS Online versions ant\u00e9rieures \u00e0 2.6-GS",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Controller M218",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "HMISCU Controller",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon Controller M251",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Easy Harmony ET6 (HMIET Series) et Easy Harmony GXU (HMIGXU Series) avec Vijeo Designer Basic versions ant\u00e9rieures \u00e0 V1.2.1 Hotfix 4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "APC Easy UPS Online Monitoring versions ant\u00e9rieures \u00e0 2.6-GA",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M580 Ethernet Communication Modules (BMENOC0301 et BMENOC0311) versions ant\u00e9rieures \u00e0 SV2.21",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    },
    {
      "description": "Modicon M340 CPU versions ant\u00e9rieures \u00e0 SV3.51",
      "product": {
        "name": "Modicon M340",
        "vendor": {
          "name": "Schneider Electric",
          "scada": true
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2023-29413",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29413"
    },
    {
      "name": "CVE-2023-29410",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29410"
    },
    {
      "name": "CVE-2020-35198",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-35198"
    },
    {
      "name": "CVE-2022-4046",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
    },
    {
      "name": "CVE-2023-29412",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29412"
    },
    {
      "name": "CVE-2023-27976",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-27976"
    },
    {
      "name": "CVE-2022-34755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-34755"
    },
    {
      "name": "CVE-2023-25620",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25620"
    },
    {
      "name": "CVE-2023-1548",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-1548"
    },
    {
      "name": "CVE-2023-29411",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-29411"
    },
    {
      "name": "CVE-2023-28355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-28355"
    },
    {
      "name": "CVE-2023-25619",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-25619"
    },
    {
      "name": "CVE-2022-45788",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-45788"
    },
    {
      "name": "CVE-2022-4224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-4224"
    },
    {
      "name": "CVE-2021-29241",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-29241"
    },
    {
      "name": "CVE-2020-28895",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-28895"
    }
  ],
  "initial_release_date": "2023-04-11T00:00:00",
  "last_revision_date": "2023-04-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2023-AVI-0297",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2023-04-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits\nSchneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de\nservice \u00e0 distance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2022-011-06 du 11 janvier 2022",
      "url": "https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2022-011-06_CODESYSV3_Runtime_Development_System_and_Gateway_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-05 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-05.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-06 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-06\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-06.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-04 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-04.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-02 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-02.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-03 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-03.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-101-01 du 11 avril 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-101-01.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2023-010-05 du 10 janvier 2023",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-010-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-010-05_Modicon_Controllers_Security_Notification.pdf"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2021-313-05 du 09 novembre 2021",
      "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-313-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2021-313-05_BadAlloc_Vulnerabilities_Security_Notification.pdf"
    }
  ]
}

{
  "GSD": {
    "alias": "CVE-2023-28355",
    "id": "GSD-2023-28355"
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2023-28355"
      ],
      "id": "GSD-2023-28355",
      "modified": "2023-12-13T01:20:47.183852Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "cve@mitre.org",
        "ID": "CVE-2023-28355",
        "STATE": "RESERVED"
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided."
          }
        ]
      }
    }
  }
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "Schneider Electric CPCERT",
        "summary": "reported these vulnerabilities to CISA."
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Disclosure is not limited",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.cisa.gov/news-events/news/traffic-light-protocol-tlp-definitions-and-usage"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "We strongly recommend the following industry cybersecurity best practices.\n\nhttps://www.se.com/us/en/download/document/7EN52-0390/\n* Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network.\n* Install physical controls so no unauthorized personnel can access your industrial control and safety systems, components, peripheral equipment, and networks.\n* Place all controllers in locked cabinets and never leave them in the \u201cProgram\u201d mode.\n* Never connect programming software to any network other than the network intended for that device.\n* Scan all methods of mobile data exchange with the isolated network such as CDs, USB drives, etc. before use in the terminals or any node connected to these networks.\n* Never allow mobile devices that have connected to any other network besides the intended network to connect to the safety or control networks without proper sanitation.\n* Minimize network exposure for all control system devices and systems and ensure that they are not accessible from the Internet.\n* When remote access is required, use secure methods, such as Virtual Private Networks (VPNs). Recognize that VPNs may have vulnerabilities and should be updated to the most current version available. Also, understand that VPNs are only as secure as the connected devices.\nFor more information refer to the Schneider Electric Recommended Cybersecurity Best Practices document. \n",
        "title": "General Security Recommendations"
      },
      {
        "category": "general",
        "text": "This document provides an overview of the identified vulnerability or vulnerabilities and actions required to mitigate. For more details and assistance on how to protect your installation, contact your local Schneider Electric representative or Schneider Electric Industrial Cybersecurity Services: https://www.se.com/ww/en/work/solutions/cybersecurity/. These organizations will be fully aware of this situation and can support you through the process.\nFor further information related to cybersecurity in Schneider Electric\u2019s products, visit the company\u2019s cybersecurity support portal page: https://www.se.com/ww/en/work/support/cybersecurity/overview.jsp",
        "title": "For More Information"
      },
      {
        "category": "legal_disclaimer",
        "text": "THIS NOTIFICATION DOCUMENT, THE INFORMATION CONTAINED HEREIN, AND ANY MATERIALS LINKED FROM IT (COLLECTIVELY, THIS \u201cNOTIFICATION\u201d) ARE INTENDED TO HELP PROVIDE AN OVERVIEW OF THE IDENTIFIED SITUATION AND SUGGESTED MITIGATION ACTIONS, REMEDIATION, FIX, AND/OR GENERAL SECURITY RECOMMENDATIONS AND IS PROVIDED ON AN \u201cAS-IS\u201d BASIS WITHOUT WARRANTY OR GUARANTEE OF ANY KIND.  SCHNEIDER ELECTRIC DISCLAIMS ALL WARRANTIES RELATING TO THIS NOTIFICATION, EITHER EXPRESS OR IMPLIED, INCLUDING WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. SCHNEIDER ELECTRIC MAKES NO WARRANTY THAT THE NOTIFICATION WILL RESOLVE THE IDENTIFIED SITUATION. IN NO EVENT SHALL SCHNEIDER ELECTRIC BE LIABLE FOR ANY DAMAGES OR LOSSES WHATSOEVER IN CONNECTION WITH THIS NOTIFICATION, INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF SCHNEIDER ELECTRIC HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. YOUR USE OF THIS NOTIFICATION IS AT YOUR OWN RISK, AND YOU ARE SOLELY LIABLE FOR ANY DAMAGES TO YOUR SYSTEMS OR ASSETS OR OTHER LOSSES THAT MAY RESULT FROM YOUR USE OF THIS NOTIFICATION. SCHNEIDER ELECTRIC RESERVES THE RIGHT TO UPDATE OR CHANGE THIS NOTIFICATION AT ANY TIME AND IN ITS SOLE DISCRETION",
        "title": "LEGAL DISCLAIMER"
      },
      {
        "category": "general",
        "text": "Schneider\u2019s purpose is to create Impact by empowering all to make the most of our energy and resources, bridging progress and\r\nsustainability for all. We call this Life Is On.\n\nOur mission is to be the trusted partner in Sustainability and Efficiency.\n\nWe are a global industrial technology leader bringing world-leading expertise in electrification, automation and digitization to smart\r\nindustries, resilient infrastructure, future-proof data centers, intelligent buildings, and intuitive homes. Anchored by our deep\r\ndomain expertise, we provide integrated end-to-end lifecycle AI enabled Industrial IoT solutions with connected products, automation,\r\nsoftware and services, delivering digital twins to enable profitable growth for our customers.\n\nWe are a people company with an ecosystem of 150,000 colleagues and more than a million partners operating in over 100 countries\r\nto ensure proximity to our customers and stakeholders. We embrace diversity and inclusion in everything we do, guided by our\r\nmeaningful purpose of a sustainable future for all.",
        "title": "About Schneider Electric"
      },
      {
        "category": "summary",
        "text": "Schneider Electric is aware of multiple vulnerabilities disclosed on CODESYS runtime system V3 communication server. Many vendors, including Schneider Electric, embed CODESYS in their offers. \r\n\r\nIf successfully exploited, these vulnerabilities could result in a denial of service or, in some cases, in remote code execution on PacDrive controllers, Modicon Controllers M241 / M251 / M262 / M258 / LMC058 / LMC078 / M218 ,  HMISCU, the Simulation Runtime SoftSPS from EcoStruxure Machine Expert and EcoStruxure Microgrid Operation products. \r\n\r\nFailure to apply the mitigations provided below may result in denial of service and/or arbitrary remote code execution.  ",
        "title": "Overview"
      },
      {
        "category": "details",
        "text": "Vulnerabilities disclosed by CODESYSTM group in the CODESYS Runtime and Simulation Runtime impact Schneider Electric controller products and software. \n\nAdditional information about the vulnerabilities can be found in the CODESYSTM Advisories at: \n Advisory 2023-02 \u2022 Advisory 2023-03\n \u2022 Advisory 2023-04\n \u2022 Advisory 2023-05\n \u2022 Advisory 2023-06\n \u2022 Advisory 2023-07\n \u2022 Advisory 2023-08 \n \u2022 Advisory 2023-09 ",
        "title": "Details"
      },
      {
        "category": "other",
        "text": "Customers should use appropriate patching methodologies when applying these patches to their systems. We strongly recommend the use of back-ups and evaluating the impact of these patches in a Test and Development environment or on an offline infrastructure. Contact Schneider Electric\u2019s Customer Care Center https://www.se.com/us/en/work/support/contacts.jsp if you need assistance removing a patch. "
      },
      {
        "category": "legal_disclaimer",
        "text": "This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy \u0026 Use policy (https://www.cisa.gov/privacy-policy).",
        "title": "Legal Notice and Terms of Use"
      },
      {
        "category": "other",
        "text": "This ICSA is a verbatim republication of Schneider Electric CPCERT SEVD-2023-192-04 from a direct conversion of the vendor\u0027s Common Security Advisory Framework (CSAF) advisory. This is republished to CISA\u0027s website as a means of increasing visibility and is provided \"as-is\" for informational purposes only. CISA is not responsible for the editorial or technical accuracy of republished advisories and provides no warranties of any kind regarding any information contained within this advisory.  Further, CISA does not endorse any commercial product or service.  Please contact Schneider Electric CPCERT directly for any questions regarding this advisory.",
        "title": "Advisory Conversion Disclaimer"
      },
      {
        "category": "other",
        "text": "Commercial Facilities, Critical Manufacturing, Energy",
        "title": "Critical infrastructure sectors"
      },
      {
        "category": "other",
        "text": "Worldwide",
        "title": "Countries/areas deployed"
      },
      {
        "category": "other",
        "text": "France",
        "title": "Company headquarters location"
      },
      {
        "category": "general",
        "text": "CISA recommends users take defensive measures to minimize the exploitation risk of this vulnerability.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Minimize network exposure for all control system devices and/or systems, and ensure they are not accessible from the internet.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Locate control system networks and remote devices behind firewalls and isolate them from business networks.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most recent version available. Also recognize VPN is only as secure as its connected devices.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies.",
        "title": "Recommended Practices"
      },
      {
        "category": "general",
        "text": "Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.",
        "title": "Recommended Practices"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "central@cisa.dhs.gov",
      "name": "CISA",
      "namespace": "https://www.cisa.gov/"
    },
    "references": [
      {
        "category": "self",
        "summary": "CODESYS Runtime Vulnerabilities - SEVD-2023-192-04 CSAF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=sevd-2023-192-04.json"
      },
      {
        "category": "self",
        "summary": "CODESYS Runtime Vulnerabilities - SEVD-2023-192-04 PDF Version",
        "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-192-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2023-192-04.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Cybersecurity Best Practices",
        "url": "https://www.se.com/us/en/download/document/7EN52-0390/"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-26-020-02 JSON",
        "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-020-02.json"
      },
      {
        "category": "self",
        "summary": "ICS Advisory ICSA-26-020-02 - Web Version",
        "url": "https://www.cisa.gov/news-events/ics-advisories/icsa-26-020-02"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/ics-alerts/ics-alert-10-301-01"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/resources-tools/resources/ics-recommended-practices"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/topics/industrial-control-systems"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf"
      },
      {
        "category": "external",
        "summary": "Recommended Practices",
        "url": "https://www.cisa.gov/news-events/news/targeted-cyber-intrusion-detection-and-mitigation-strategies-update-b"
      }
    ],
    "title": "Schneider Electric devices using CODESYS Runtime",
    "tracking": {
      "current_release_date": "2026-01-20T15:49:51.778731Z",
      "generator": {
        "date": "2026-01-20T15:49:51.777331Z",
        "engine": {
          "name": "CISA CSAF Generator",
          "version": "1.5.0"
        }
      },
      "id": "ICSA-26-020-02",
      "initial_release_date": "2023-07-11T07:15:18.000000Z",
      "revision_history": [
        {
          "date": "2023-07-11T07:15:18.000000Z",
          "legacy_version": "Initial",
          "number": "1",
          "summary": "Original Release"
        },
        {
          "date": "2023-08-08T15:41:00.000000Z",
          "legacy_version": "Revision 1",
          "number": "2",
          "summary": "New CODESYS advisories 2023-04 to 2023-09 added. Additional impacted product: Harmony and Easy Harmony, Vijeo Designer embedded in EcoStruxure Machine Expert."
        },
        {
          "date": "2024-01-09T00:00:00.000000Z",
          "legacy_version": "Revision 2",
          "number": "3",
          "summary": "Remediations added for different products."
        },
        {
          "date": "2024-03-12T00:00:00.000000Z",
          "legacy_version": "Revision 3",
          "number": "4",
          "summary": "A remediation is now available for HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series"
        },
        {
          "date": "2024-04-09T00:00:00.000000Z",
          "legacy_version": "Revision 4",
          "number": "5",
          "summary": "A remediation is now available for Easy Harmony HMIET6/HMIFT6, and Magelis HMIGXU series"
        },
        {
          "date": "2024-06-11T00:00:00.000000Z",
          "legacy_version": "Revision 5",
          "number": "6",
          "summary": "Easy Modicon M310 is added to the list of products impacted"
        },
        {
          "date": "2025-08-12T04:00:00.000000Z",
          "legacy_version": "Revision 6",
          "number": "7",
          "summary": "Remediations are available for Harmony iPC series and Harmony P6 series with Vijeo Designer."
        },
        {
          "date": "2025-11-11T08:00:00.000000Z",
          "legacy_version": "Revision 7",
          "number": "8",
          "summary": "Remediation is available for Easy Modicon M310."
        },
        {
          "date": "2025-12-09T08:00:00.000000Z",
          "legacy_version": "Revision 8",
          "number": "9",
          "summary": "Replaced advisory IDs with CVE IDs. Added vulnerability details, including CVE descriptions, CWE identifiers, CVSS scores, and vector strings. Corrected mappings of affected and fixed products for each CVE."
        },
        {
          "date": "2026-01-20T15:49:51.778731Z",
          "legacy_version": "CISA Republication",
          "number": "10",
          "summary": "Initial Republication of Schneider Electric CPCERT SEVD-2023-192-04 advisory"
        }
      ],
      "status": "final",
      "version": "10"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3.1",
                "product": {
                  "name": "Schneider Electric HMISCU Controller All versions prior to v6.3.1",
                  "product_id": "CSAFPID-0001"
                }
              }
            ],
            "category": "product_name",
            "name": "HMISCU Controller"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller LMC078 All Versions",
                  "product_id": "CSAFPID-0002"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller LMC078"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M241 All versions prior to v5.2.11.18",
                  "product_id": "CSAFPID-0003"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M241"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M251 All Versions prior to v5.2.11.18",
                  "product_id": "CSAFPID-0004"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M251"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c5.2.8.12",
                "product": {
                  "name": "Schneider Electric Modicon Controller M262 All versions prior to v5.2.8.12",
                  "product_id": "CSAFPID-0005"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M262"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M258 All Versions",
                  "product_id": "CSAFPID-0006"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M258"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller LMC058 All Versions",
                  "product_id": "CSAFPID-0007"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller LMC058"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Modicon Controller M218 All Versions",
                  "product_id": "CSAFPID-0008"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M218"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c1.76.14.1",
                "product": {
                  "name": "Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2  All versions prior to v1.76.14.1",
                  "product_id": "CSAFPID-0009"
                }
              }
            ],
            "category": "product_name",
            "name": "PacDrive 3 Controllers: LMC Eco/Pro/Pro2 "
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.2",
                "product": {
                  "name": "Schneider Electric SoftSPS embedded in EcoStruxure Machine Expert  All Versions prior to Machine Expert v2.2",
                  "product_id": "CSAFPID-0010"
                }
              }
            ],
            "category": "product_name",
            "name": "SoftSPS embedded in EcoStruxure Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3.1",
                "product": {
                  "name": "Schneider Electric Vijeo Designer embedded in EcoStruxure Machine Expert  All versions prior to v6.3.1",
                  "product_id": "CSAFPID-0011"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer embedded in EcoStruxure Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3_HF3",
                "product": {
                  "name": "Schneider Electric Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series All Versions prior to  V6.3 HF3",
                  "product_id": "CSAFPID-0012"
                }
              }
            ],
            "category": "product_name",
            "name": "Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c2.0_HF2",
                "product": {
                  "name": "Schneider Electric Easy Harmony HMIET6/HMIFT6 Magelis HMIGXU all versions prior to v2.0 HF2",
                  "product_id": "CSAFPID-0013"
                }
              }
            ],
            "category": "product_name",
            "name": "Easy Harmony HMIET6/HMIFT6 Magelis HMIGXU series"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3.1",
                "product": {
                  "name": "Schneider Electric HMISCU Controller 6.3.1",
                  "product_id": "CSAFPID-0014"
                }
              }
            ],
            "category": "product_name",
            "name": "HMISCU Controller"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M241 5.2.11.18",
                  "product_id": "CSAFPID-0015"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M241"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "5.2.11.18",
                "product": {
                  "name": "Schneider Electric Modicon Controller M251 5.2.11.18",
                  "product_id": "CSAFPID-0016"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M251"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "5.2.8.12",
                "product": {
                  "name": "Schneider Electric Modicon Controller M262 5.2.8.12",
                  "product_id": "CSAFPID-0017"
                }
              }
            ],
            "category": "product_name",
            "name": "Modicon Controller M262"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "1.76.14.1",
                "product": {
                  "name": "Schneider Electric PacDrive 3 Controllers: LMC Eco/Pro/Pro2  1.76.14.1",
                  "product_id": "CSAFPID-0018"
                }
              }
            ],
            "category": "product_name",
            "name": "PacDrive 3 Controllers: LMC Eco/Pro/Pro2 "
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.2",
                "product": {
                  "name": "Schneider Electric SoftSPS embedded in EcoStruxure Machine Expert 2.2",
                  "product_id": "CSAFPID-0019"
                }
              }
            ],
            "category": "product_name",
            "name": "SoftSPS embedded in EcoStruxure Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3.1",
                "product": {
                  "name": "Schneider Electric Vijeo Designer embedded in EcoStruxure Machine Expert  6.3.1",
                  "product_id": "CSAFPID-0020"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer embedded in EcoStruxure Machine Expert "
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3_HF3",
                "product": {
                  "name": "Schneider Electric Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series iPC series with Vijeo Designer runtime V6.3 HF3",
                  "product_id": "CSAFPID-0021"
                }
              }
            ],
            "category": "product_name",
            "name": "Harmony (Formerly Magelis) HMIGK/HMIGTO/HMIGTU/HMIGTUX/HMISTU series iPC series with Vijeo Designer runtime"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "2.0_HotFix_2",
                "product": {
                  "name": "Vijeo Designer Basic v2.0 HF2",
                  "product_id": "CSAFPID-0022"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer Basic"
          },
          {
            "category": "product_name",
            "name": "Harmony iPC series",
            "product": {
              "name": "Schneider Electric Harmony iPC series",
              "product_id": "CSAFPID-0023"
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:all/*",
                "product": {
                  "name": "Schneider Electric Magelis XBT series All Versions",
                  "product_id": "CSAFPID-0024"
                }
              }
            ],
            "category": "product_name",
            "name": "Magelis XBT series"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.1.5.82",
                "product": {
                  "name": "Schneider Electric Easy Modicon M310 All versions prior to v3.1.5.82",
                  "product_id": "CSAFPID-0025"
                }
              }
            ],
            "category": "product_name",
            "name": "Easy Modicon M310"
          },
          {
            "category": "product_name",
            "name": "Harmony P6 series",
            "product": {
              "name": "Schneider Electric Harmony P6 series",
              "product_id": "CSAFPID-0026"
            }
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.3_SP2",
                "product": {
                  "name": "Schneider Electric Vijeo Designer runtime \u003c6.3 SP2",
                  "product_id": "CSAFPID-0027"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer runtime"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "6.3_SP2",
                "product": {
                  "name": "Schneider Electric Vijeo Designer runtime 6.3 SP2",
                  "product_id": "CSAFPID-0028"
                }
              }
            ],
            "category": "product_name",
            "name": "Vijeo Designer runtime"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "3.1.5.82",
                "product": {
                  "name": "Schneider Electric Easy Modicon M310 version v3.1.5.82",
                  "product_id": "CSAFPID-0029"
                }
              }
            ],
            "category": "product_name",
            "name": "Easy Modicon M310"
          }
        ],
        "category": "vendor",
        "name": "Schneider Electric"
      }
    ],
    "relationships": [
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony iPC series",
          "product_id": "CSAFPID-0030"
        },
        "product_reference": "CSAFPID-0027",
        "relates_to_product_reference": "CSAFPID-0023"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Version 6.3 SP2 installed on Schneider Electric Harmony iPC series",
          "product_id": "CSAFPID-0031"
        },
        "product_reference": "CSAFPID-0028",
        "relates_to_product_reference": "CSAFPID-0023"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Versions Prior to 6.3 SP2 installed on Schneider Electric Harmony P6 series",
          "product_id": "CSAFPID-0032"
        },
        "product_reference": "CSAFPID-0027",
        "relates_to_product_reference": "CSAFPID-0026"
      },
      {
        "category": "installed_on",
        "full_product_name": {
          "name": "Schneider Electric Vijeo Designer runtime Version 6.3 SP2 installed on Schneider Electric Harmony P6 series",
          "product_id": "CSAFPID-0033"
        },
        "product_reference": "CSAFPID-0028",
        "relates_to_product_reference": "CSAFPID-0026"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4046",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "In addition to the functionality described above, there are memory access functions that allow the PLC application code to read or write memory. These are not limited to the data memories that are assigned to it or allocated by it. For this reason, the PLC application code can potentially access the entire RAM memory of the CODESYS Control runtime process surrounding it. This could allow PLC programmers who have successfully authenticated themselves at the controller to execute PLC application code that can modify itself or read or write sensitive data of the CODESYS Control runtime process.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-4046"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/119.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u00b4s Modicon LMC078 controllers have reached end of their life and are no longer commercially available. They have been replaced by the Modicon M262 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Modicon M218 controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon Easy M200 and Modicon M241 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-4046"
    },
    {
      "cve": "CVE-2023-28355",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "The PLC application code executed by the CODESYS Control Runtime contains a checksum. This enables the CODESYS development system to check at login whether its loaded project matches the PLC application code executed on the controller. This checksum is not sufficient to reliably detect PLC application code that has been modified in memory or boot application files that have been manipulated.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0002",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0008",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-28355"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/354.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u00b4s Modicon LMC078 controllers have reached end of their life and are no longer commercially available. They have been replaced by the Modicon M262 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0002"
          ]
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Modicon M218 controllers have reached their end of life and are no longer commercially available. They have been replaced by the Modicon Easy M200 and Modicon M241 controllers. We recommend our customers to migrate to the latest offer. Please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0008"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0002",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0008",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-28355"
    },
    {
      "cve": "CVE-2022-47378",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests with inconsistent content can cause the CmpFiletransfer component to read internally from an invalid address, potentially leading to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47378"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/1288.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47378"
    },
    {
      "cve": "CVE-2022-47379",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpApp component to write attacker-controlled data to memory, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47379"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/787.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47379"
    },
    {
      "cve": "CVE-2022-47380",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpApp component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47380"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47380"
    },
    {
      "cve": "CVE-2022-47381",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpApp component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47381"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47381"
    },
    {
      "cve": "CVE-2022-47382",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47382"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47382"
    },
    {
      "cve": "CVE-2022-47383",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47383"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47383"
    },
    {
      "cve": "CVE-2022-47384",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47384"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47384"
    },
    {
      "cve": "CVE-2022-47386",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47386"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47386"
    },
    {
      "cve": "CVE-2022-47387",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47387"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47387"
    },
    {
      "cve": "CVE-2022-47388",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47388"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47388"
    },
    {
      "cve": "CVE-2022-47389",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47389"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47389"
    },
    {
      "cve": "CVE-2022-47390",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpTraceMgr component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47390"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47390"
    },
    {
      "cve": "CVE-2022-47385",
      "cwe": {
        "id": "CWE-121",
        "name": "Stack-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpAppForce component to write attacker-controlled data to stack, which can lead to a denial-of-service condition, memory overwriting, or remote code execution.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47385"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/121.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47385"
    },
    {
      "cve": "CVE-2022-47392",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests with inconsistent content can cause the CmpApp/CmpAppBP/CmpAppForce components to read internally from an invalid address, potentially leading to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47392"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/1288.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47392"
    },
    {
      "cve": "CVE-2022-47393",
      "cwe": {
        "id": "CWE-822",
        "name": "Untrusted Pointer Dereference"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication, specific crafted communication requests can cause the CmpFiletransfer component to dereference addresses provided by the request for internal read access, which can lead to a denial-of-service situation.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47393"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/822.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47393"
    },
    {
      "cve": "CVE-2022-47391",
      "cwe": {
        "id": "CWE-1288",
        "name": "Improper Validation of Consistency within Input"
      },
      "notes": [
        {
          "category": "description",
          "text": "Crafted communication requests can cause the affected products to read internally from an invalid address, potentially leading to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2022-47391"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/1288.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2022-47391"
    },
    {
      "cve": "CVE-2023-37545",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37545"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37545"
    },
    {
      "cve": "CVE-2023-37546",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37546"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37546"
    },
    {
      "cve": "CVE-2023-37547",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37547"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37547"
    },
    {
      "cve": "CVE-2023-37548",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37548"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37548"
    },
    {
      "cve": "CVE-2023-37549",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37549"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37549"
    },
    {
      "cve": "CVE-2023-37550",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpApp component to read internally from an invalid address, potentially leading to a denial-ofservice condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37550"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37550"
    },
    {
      "cve": "CVE-2023-37551",
      "cwe": {
        "id": "CWE-552",
        "name": "Files or Directories Accessible to External Parties"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specially crafted communication requests can utilize the CmpApp component to download files with any file extensions to the controller. In contrast to the regular file download via CmpFileTransfer, no filtering of certain file types is performed here. As a result, the integrity of the CODESYS control runtime system may be compromised by the files loaded onto the controller.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37551"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/552.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37551"
    },
    {
      "cve": "CVE-2023-37552",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37552"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37552"
    },
    {
      "cve": "CVE-2023-37553",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37553"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37553"
    },
    {
      "cve": "CVE-2023-37554",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37554"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37554"
    },
    {
      "cve": "CVE-2023-37555",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37555"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37555"
    },
    {
      "cve": "CVE-2023-37556",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppBP component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37556"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37556"
    },
    {
      "cve": "CVE-2023-37557",
      "cwe": {
        "id": "CWE-787",
        "name": "Out-of-bounds Write"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests can cause the CmpAppBP component to overwrite a heap-based buffer, which can lead to a denial-of-service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37557"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/787.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37557"
    },
    {
      "cve": "CVE-2023-37558",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37558"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37558"
    },
    {
      "cve": "CVE-2023-37559",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "notes": [
        {
          "category": "description",
          "text": "After successful authentication as a user, specific crafted communication requests with inconsistent content can cause the CmpAppForce component to read internally from an invalid address, potentially leading to a denial-of service condition.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-37559"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/20.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-37559"
    },
    {
      "cve": "CVE-2023-3662",
      "cwe": {
        "id": "CWE-427",
        "name": "Uncontrolled Search Path Element"
      },
      "notes": [
        {
          "category": "description",
          "text": "The CODESYS Development System is vulnerable to the execution of malicious binaries from the current working directory.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-3662"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/427.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-3662"
    },
    {
      "cve": "CVE-2023-3663",
      "cwe": {
        "id": "CWE-924",
        "name": "Improper Enforcement of Message Integrity During Transmission in a Communication Channel"
      },
      "notes": [
        {
          "category": "description",
          "text": "The Notification Center of the CODESYS Development System receives messages without ensuring that the message was not modified during transmission. This finally enables MITMs code execution when the user clicks the Learn More button.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-3663"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/924.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-3663"
    },
    {
      "cve": "CVE-2023-3669",
      "cwe": {
        "id": "CWE-307",
        "name": "Improper Restriction of Excessive Authentication Attempts"
      },
      "notes": [
        {
          "category": "description",
          "text": "The Notification Center of the CODESYS Development System receives messages without ensuring that the message was not modified during transmission. This finally enables MITMs code execution when the user clicks the Learn More button.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-3669"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/307.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-3669"
    },
    {
      "cve": "CVE-2023-3670",
      "cwe": {
        "id": "CWE-668",
        "name": "Exposure of Resource to Wrong Sphere"
      },
      "notes": [
        {
          "category": "description",
          "text": "CODESYS Scripting executes potentially malicious scripts saved by another user.",
          "title": "Overview"
        }
      ],
      "product_status": {
        "fixed": [
          "CSAFPID-0014",
          "CSAFPID-0015",
          "CSAFPID-0016",
          "CSAFPID-0017",
          "CSAFPID-0018",
          "CSAFPID-0019",
          "CSAFPID-0020",
          "CSAFPID-0021",
          "CSAFPID-0022",
          "CSAFPID-0031",
          "CSAFPID-0033",
          "CSAFPID-0029"
        ],
        "known_affected": [
          "CSAFPID-0001",
          "CSAFPID-0003",
          "CSAFPID-0004",
          "CSAFPID-0005",
          "CSAFPID-0006",
          "CSAFPID-0007",
          "CSAFPID-0009",
          "CSAFPID-0010",
          "CSAFPID-0011",
          "CSAFPID-0012",
          "CSAFPID-0013",
          "CSAFPID-0024",
          "CSAFPID-0025",
          "CSAFPID-0030",
          "CSAFPID-0032"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "www.cve.org",
          "url": "https://www.cve.org/CVERecord?id=CVE-2023-3670"
        },
        {
          "category": "external",
          "summary": "cwe.mitre.org",
          "url": "https://cwe.mitre.org/data/definitions/668.html"
        },
        {
          "category": "external",
          "summary": "www.first.org",
          "url": "https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer. In order to complete the update, connect to Harmony HMI and download the project file using Vijeo Designer v6.3.1.",
          "product_ids": [
            "CSAFPID-0001"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M241 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M241 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0003"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M251 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M251 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0004"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Modicon Controller M262 Firmware delivered with Machine Expert v2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to v2.2 of Machine Expert. Update Modicon Controller M262 to the latest firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0005"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "no_fix_planned",
          "details": "Schneider Electric\u2019s Magelis XBT series have reached their end of commercialization. Magelis XBTGT/XBTGK offers have been replaced by HMIGTO/HMIGTU/HMIGK. We recommend our customers to migrate to the latest offers. For Magelis XBT series that haven\u0027t been replaced, please contact your local Schneider Electric technical support for more information.",
          "product_ids": [
            "CSAFPID-0024"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "PacDrive 3 Controllers LMC Eco/Pro/Pro2 Firmware delivered with Machine Expert V2.2 includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/ On the engineering workstation, update to V2.2 of Machine Expert. Update PacDrive 3 Controllers: LMC Eco/Pro/Pro2 to the latest Firmware and preform reboot.",
          "product_ids": [
            "CSAFPID-0009"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3.1 of Vijeo Designer includes a fix for this vulnerability and can be updated through the Schneider Electric Software Update (SESU) application. https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware On the engineering workstation, update to v6.3.1 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0011"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeodesigner-hmi-software/#software-and-firmware"
        },
        {
          "category": "vendor_fix",
          "details": "SoftSPS component has been removed from Machine Expert V2.2. Machine Expert can be updated through the Schneider Electric Software Update (SESU) application. ",
          "product_ids": [
            "CSAFPID-0010"
          ],
          "url": "https://www.se.com/ww/en/product-range/2226-ecostruxure-machine-expert-software/"
        },
        {
          "category": "mitigation",
          "details": "\u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use. \u2022 Use encrypted communication links. \u2022 The \u201cCybersecurity Guidelines for EcoStruxure Machine Expert, Modicon and PacDrive Controllers and Associated Equipment\u201d provide mitigations through the activation of project encryption in the Enhanced Security Settings, chapter https://download.schneiderelectric.com/files?p_enDocType=User+guide\u0026p_File_Name=EIO0000004242.00.pdf\u0026p_Doc_Ref=EIO0000004242. \u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/1105.",
          "product_ids": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009"
          ]
        },
        {
          "category": "mitigation",
          "details": "\u2022 Enable the optional \u2018Implicit Checks\u2019 on logic applications. \u2022 Avoid use of the POINTER data type and MEMMOVE instructions, especially on untrusted inputs. \u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside. \u2022 Use firewalls to protect and separate the control system network from other networks. \u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by using up to date malware protection. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric\u2019s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications.jsp",
          "product_ids": [
            "CSAFPID-0010"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Version 3.1.5.82 includes a fix for this vulnerability\r\nand can be download here: \r\nhttps://www.se.com/ww/en/product-range/268959560-easy-modicon-m310 \r\nAs an alternative, contact your Schneider Electric \r\nCustomer Care Center to obtain the firmware. \r\nTo complete the update, connect to M310 and \r\ndownload the firmware using EcoStruxureTM Motion \r\nExpert.",
          "product_ids": [
            "CSAFPID-0025"
          ],
          "url": "https://www.se.com/ww/en/product-range/268959560-easy-modicon-m310"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 HF3 of Vijeo Designer includes a fix for \n this vulnerability and can be updated through the \nSchneider Electric Software Update (SESU) \napplication.\nAs an alternative, please contact your Schneider \nElectric Customer Care Center to obtain the Hot Fix. \nFor additional detail please refer to the supplied help \nfile in Hot Fix.\nOn the engineering workstation, update to v6.3 HF3 \nof Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0012"
          ]
        },
        {
          "category": "vendor_fix",
          "details": "Vijeo Designer Basic v2.0 HotFix 2 includes a fix for \nthis vulnerability. Please contact your Schneider \nElectric Customer Care Center to obtain the installer. \nTo complete the update, connect to Harmony HMI \nand download the firmware using Vijeo Designer \nBasic.",
          "product_ids": [
            "CSAFPID-0013"
          ],
          "url": "https://www.se.com/us/en/work/support/contacts.jsp"
        },
        {
          "category": "vendor_fix",
          "details": "Version 6.3 SP2 of Vijeo Designer includes a fix \r\nfor this vulnerability and can be updated through \r\nthe Schneider Electric Software Update (SESU) \r\napplication.\r\nhttps://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware\r\nAs an alternative, please contact your Schneider \r\nElectric Customer Care Center to obtain the Fix.\r\nFor additional details, please refer to the supplied \r\nhelp file in Hot Fix.\r\nOn the engineering workstation, update to v6.3 \r\nSP2 of Vijeo Designer.",
          "product_ids": [
            "CSAFPID-0030",
            "CSAFPID-0032"
          ],
          "url": "https://www.se.com/ww/en/product-range/1054-vijeo-designer-hmi-software/#software-and-firmware"
        },
        {
          "category": "mitigation",
          "details": "Customers should immediately apply the following mitigations to reduce the risk of exploitation: \u2022 Ensure usage of user management and password features. User rights are enabled by default and forced to create a strong password at first use.\u2022 Restrict access to programming ports, typically UDP/1740, TCP/11740 and TCP/484.\u2022 Use controllers and devices only in a protected environment to minimize network exposure and ensure that they are not accessible from outside.\u2022 Use firewalls to protect and separate the control system network from other networks.\u2022 Use VPN (Virtual Private Networks) tunnels if remote access is required. \u2022 Limit the access to both development and control system by physical means, operating system features, etc. \u2022 Protect both development and control system by  using up to date malware protection.",
          "product_ids": [
            "CSAFPID-0025"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-0001",
            "CSAFPID-0003",
            "CSAFPID-0004",
            "CSAFPID-0005",
            "CSAFPID-0006",
            "CSAFPID-0007",
            "CSAFPID-0009",
            "CSAFPID-0010",
            "CSAFPID-0011",
            "CSAFPID-0012",
            "CSAFPID-0013",
            "CSAFPID-0024",
            "CSAFPID-0025",
            "CSAFPID-0030",
            "CSAFPID-0032"
          ]
        }
      ],
      "title": "CVE-2023-3670"
    }
  ]
}

{
  "document": {
    "acknowledgments": [
      {
        "organization": "CERT@VDE",
        "summary": "coordination",
        "urls": [
          "https://certvde.com"
        ]
      },
      {
        "names": [
          "Reid Wightman"
        ],
        "organization": "Dragos Inc.",
        "summary": "reporting"
      }
    ],
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-GB",
    "notes": [
      {
        "category": "summary",
        "text": "The CODESYS Control V3 runtime system does not restrict the memory accesses of the PLC application code to the PLC application data and does not sufficiently check the integrity of the application code by default. This could be exploited by authenticated PLC programmers.",
        "title": "Summary"
      },
      {
        "category": "description",
        "text": "The CODESYS Control runtime system enables embedded or PC-based devices to be a programmable industrial controller. Control programs (PLC application code) can access local or remote IOs, communication interfaces such as serial or sockets, or the file system.",
        "title": "Impact"
      },
      {
        "category": "description",
        "text": "To exploit these vulnerabilities, a successful login to the affected product is required. The online user management therefore protects from exploiting these security vulnerabilities.\n\n\nCODESYS GmbH strongly recommends using the online user management. This not only prevents from downloading malicious code or boot application files, but also suppresses starting, stopping, debugging or other actions on a known working application that could potentially disrupt a machine or system. As of version 3.5.17.0, the online user management is enforced by default.\n\n\nIn addition, the CODESYS Development System and the CODESYS Control runtime system support optional signing and encryption of the application code loaded on the controller. This feature also prevents the loading and execution of untrusted or modified boot files. If the application code security policy is set to \"Enforced Signing\", a modified or untrusted application will be detected due to a missing signature and will not be loaded and executed.",
        "title": "Mitigation"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "security@codesys.com",
      "name": "CODESYS GmbH",
      "namespace": "https://www.codesys.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "VDE-2023-025: CODESYS: Control runtime system memory and integrity check vulnerabilities - HTML",
        "url": "https://certvde.com/en/advisories/VDE-2023-025/"
      },
      {
        "category": "self",
        "summary": "VDE-2023-025: CODESYS: Control runtime system memory and integrity check vulnerabilities - CSAF",
        "url": "https://codesys.csaf-tp.certvde.com/.well-known/csaf/white/2023/vde-2023-025.json"
      },
      {
        "category": "external",
        "summary": "Vendor PSIRT",
        "url": "https://www.codesys.com"
      },
      {
        "category": "external",
        "summary": "CERT@VDE Security Advisories for CODESYS GmbH",
        "url": "https://certvde.com/en/advisories/vendor/codesys/"
      }
    ],
    "title": "CODESYS: Control runtime system memory and integrity check vulnerabilities",
    "tracking": {
      "aliases": [
        "VDE-2023-025"
      ],
      "current_release_date": "2023-08-03T11:18:00.000Z",
      "generator": {
        "date": "2025-04-23T09:11:49.978Z",
        "engine": {
          "name": "Secvisogram",
          "version": "2.5.23"
        }
      },
      "id": "VDE-2023-025",
      "initial_release_date": "2023-08-03T11:18:00.000Z",
      "revision_history": [
        {
          "date": "2023-08-03T11:18:00.000Z",
          "number": "1",
          "summary": "Initial revision."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for BeagleBone SL vers:all/*",
                      "product_id": "CSAFPID-51001"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for BeagleBone SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for emPC-A/iMX6 SL vers:all/*",
                      "product_id": "CSAFPID-51002"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for emPC-A/iMX6 SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for IOT2000 SL vers:all/*",
                      "product_id": "CSAFPID-51003"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for IOT2000 SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for Linux SL vers:all/*",
                      "product_id": "CSAFPID-51004"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for Linux SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for PFC100 SL vers:all/*",
                      "product_id": "CSAFPID-51005"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for PFC100 SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for PFC200 SL vers:all/*",
                      "product_id": "CSAFPID-51006"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for PFC200 SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for PLCnext SL vers:all/*",
                      "product_id": "CSAFPID-51007"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for PLCnext SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for Raspberry Pi SL vers:all/*",
                      "product_id": "CSAFPID-51008"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for Raspberry Pi SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control for WAGO Touch Panels 600 SL vers:all/*",
                      "product_id": "CSAFPID-51009"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control for WAGO Touch Panels 600 SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control RTE (for Beckhoff CX) SL vers:all/*",
                      "product_id": "CSAFPID-510010"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control RTE (for Beckhoff CX) SL"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control RTE (SL) vers:all/*",
                      "product_id": "CSAFPID-510011"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control RTE (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control Runtime System Toolkit vers:all/*",
                      "product_id": "CSAFPID-510012"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control Runtime System Toolkit"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS Control Win (SL) vers:all/*",
                      "product_id": "CSAFPID-510013"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS Control Win (SL)"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "CODESYS HMI (SL) vers:all/*",
                      "product_id": "CSAFPID-510014"
                    }
                  }
                ],
                "category": "product_name",
                "name": "CODESYS HMI (SL)"
              }
            ],
            "category": "product_family",
            "name": "Software"
          }
        ],
        "category": "vendor",
        "name": "CODESYS"
      }
    ],
    "product_groups": [
      {
        "group_id": "CSAFGID-0001",
        "product_ids": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009",
          "CSAFPID-510010",
          "CSAFPID-510011",
          "CSAFPID-510012",
          "CSAFPID-510013",
          "CSAFPID-510014"
        ],
        "summary": "Affected products."
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-4046",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "notes": [
        {
          "category": "description",
          "text": "In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009",
          "CSAFPID-510010",
          "CSAFPID-510011",
          "CSAFPID-510012",
          "CSAFPID-510013",
          "CSAFPID-510014"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "To exploit these vulnerabilities, a successful login to the affected product is required. The online user management therefore protects from exploiting these security vulnerabilities.\n\n\nCODESYS GmbH strongly recommends using the online user management. This not only prevents from downloading malicious code or boot application files, but also suppresses starting, stopping, debugging or other actions on a known working application that could potentially disrupt a machine or system. As of version 3.5.17.0, the online user management is enforced by default.\n\n\nIn addition, the CODESYS Development System and the CODESYS Control runtime system support optional signing and encryption of the application code loaded on the controller. This feature also prevents the loading and execution of untrusted or modified boot files. If the application code security policy is set to \"Enforced Signing\", a modified or untrusted application will be detected due to a missing signature and will not be loaded and executed.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalScore": 8.8,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "temporalScore": 8.8,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009",
            "CSAFPID-510010",
            "CSAFPID-510011",
            "CSAFPID-510012",
            "CSAFPID-510013",
            "CSAFPID-510014"
          ]
        }
      ],
      "title": "CVE-2022-4046"
    },
    {
      "cve": "CVE-2023-28355",
      "cwe": {
        "id": "CWE-354",
        "name": "Improper Validation of Integrity Check Value"
      },
      "notes": [
        {
          "category": "description",
          "text": "The PLC application code executed by the CODESYS Control Runtime contains a checksum. This enables the CODESYS development system to check at login whether its loaded project matches the PLC application code executed on the controller. This checksum is not sufficient to reliably detect PLC application code that has been modified in memory or boot application files that have been manipulated.",
          "title": "Vulnerability Description"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-51001",
          "CSAFPID-51002",
          "CSAFPID-51003",
          "CSAFPID-51004",
          "CSAFPID-51005",
          "CSAFPID-51006",
          "CSAFPID-51007",
          "CSAFPID-51008",
          "CSAFPID-51009",
          "CSAFPID-510010",
          "CSAFPID-510011",
          "CSAFPID-510012",
          "CSAFPID-510013",
          "CSAFPID-510014"
        ]
      },
      "remediations": [
        {
          "category": "mitigation",
          "details": "To exploit these vulnerabilities, a successful login to the affected product is required. The online user management therefore protects from exploiting these security vulnerabilities.\n\n\nCODESYS GmbH strongly recommends using the online user management. This not only prevents from downloading malicious code or boot application files, but also suppresses starting, stopping, debugging or other actions on a known working application that could potentially disrupt a machine or system. As of version 3.5.17.0, the online user management is enforced by default.\n\n\nIn addition, the CODESYS Development System and the CODESYS Control runtime system support optional signing and encryption of the application code loaded on the controller. This feature also prevents the loading and execution of untrusted or modified boot files. If the application code security policy is set to \"Enforced Signing\", a modified or untrusted application will be detected due to a missing signature and will not be loaded and executed.",
          "group_ids": [
            "CSAFGID-0001"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "environmentalScore": 7.7,
            "environmentalSeverity": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "temporalScore": 7.7,
            "temporalSeverity": "HIGH",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-51001",
            "CSAFPID-51002",
            "CSAFPID-51003",
            "CSAFPID-51004",
            "CSAFPID-51005",
            "CSAFPID-51006",
            "CSAFPID-51007",
            "CSAFPID-51008",
            "CSAFPID-51009",
            "CSAFPID-510010",
            "CSAFPID-510011",
            "CSAFPID-510012",
            "CSAFPID-510013",
            "CSAFPID-510014"
          ]
        }
      ],
      "title": "CVE-2023-28355"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "CODESYS ist eine herstellerunabh\u00e4ngige Automatisierungssoftware f\u00fcr die Entwicklung von Steuerungsanwendungen in der industriellen Automatisierung.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in CODESYS ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuf\u00fchren, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder einen Brute-Force-Angriff durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Sonstiges",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-0943 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-0943.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-0943 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-0943"
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-06-27",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17090\u0026token=6cd08b169916366df31388d2e7ba58e7bce93508\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-04-03",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17555\u0026token=212fc7e39bdd260cab6d6ca84333d42f50bcb3da\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-03-08",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17764\u0026token=4b2f3cf3a800d076b22f18d49f278bd8883dbd46\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-10-31",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17765\u0026token=04e117e1408fdb8e02b4bc821aa3be819668aef4\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-08-03",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17766\u0026token=667d36292e99e6f6b7eb8c0b4a86d27137c31f98\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-10-31",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17767\u0026token=7ed2d9324eff98a0a319c455d0256dc7627c705e\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-08-03",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17768\u0026token=9d206ea9e0449cd9d3ee60d5179d2761dad2d2dd\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-07-26",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17769\u0026token=a1a34cd304aebfbc1e2619e401a9a6cb5d4dc117\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2023-12-05",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=17809\u0026token=c3b4e3ec4956099de26f0c6caf194d1ba341040a\u0026download="
      },
      {
        "category": "external",
        "summary": "CODESYS Advisory vom 2024-02-26",
        "url": "https://customers.codesys.com/index.php?eID=dumpFile\u0026t=f\u0026f=18027\u0026token=43109051cf95d3445bc616e4efb8414336ebcc47\u0026download="
      },
      {
        "category": "external",
        "summary": "ABB Security Advisory vom 2025-01-07",
        "url": "https://search.abb.com/library/Download.aspx?DocumentID=3ADR011377\u0026LanguageCode=en\u0026DocumentPartId=CSAF\u0026Action=Launch"
      }
    ],
    "source_lang": "en-US",
    "title": "CODESYS: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-01-07T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-08T10:42:29.688+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-0943",
      "initial_release_date": "2024-04-21T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-04-21T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2024-04-25T22:00:00.000+00:00",
          "number": "2",
          "summary": "Datum der Codesys Meldungen korrigiert."
        },
        {
          "date": "2025-01-07T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates aufgenommen"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c3.8.0",
                "product": {
                  "name": "ABB AC-500 \u003c3.8.0",
                  "product_id": "T040044"
                }
              },
              {
                "category": "product_version",
                "name": "3.8.0",
                "product": {
                  "name": "ABB AC-500 3.8.0",
                  "product_id": "T040044-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/h:abb:ac-500:3.8.0"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "AC-500"
          }
        ],
        "category": "vendor",
        "name": "ABB"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "CODESYS CODESYS",
            "product": {
              "name": "CODESYS CODESYS",
              "product_id": "T034337",
              "product_identification_helper": {
                "cpe": "cpe:/a:codesys:codesys:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "CODESYS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2022-22516",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2022-22516"
    },
    {
      "cve": "CVE-2022-4046",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2022-4046"
    },
    {
      "cve": "CVE-2022-47391",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2022-47391"
    },
    {
      "cve": "CVE-2023-28355",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-28355"
    },
    {
      "cve": "CVE-2023-3662",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3662"
    },
    {
      "cve": "CVE-2023-3663",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3663"
    },
    {
      "cve": "CVE-2023-3669",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3669"
    },
    {
      "cve": "CVE-2023-3670",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3670"
    },
    {
      "cve": "CVE-2023-37545",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37545"
    },
    {
      "cve": "CVE-2023-37546",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37546"
    },
    {
      "cve": "CVE-2023-37547",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37547"
    },
    {
      "cve": "CVE-2023-37548",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37548"
    },
    {
      "cve": "CVE-2023-37549",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37549"
    },
    {
      "cve": "CVE-2023-37550",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37550"
    },
    {
      "cve": "CVE-2023-37551",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37551"
    },
    {
      "cve": "CVE-2023-37552",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37552"
    },
    {
      "cve": "CVE-2023-37553",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37553"
    },
    {
      "cve": "CVE-2023-37554",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37554"
    },
    {
      "cve": "CVE-2023-37555",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37555"
    },
    {
      "cve": "CVE-2023-37556",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37556"
    },
    {
      "cve": "CVE-2023-37557",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37557"
    },
    {
      "cve": "CVE-2023-37558",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37558"
    },
    {
      "cve": "CVE-2023-37559",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-37559"
    },
    {
      "cve": "CVE-2023-3935",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-3935"
    },
    {
      "cve": "CVE-2023-6357",
      "notes": [
        {
          "category": "description",
          "text": "Es bestehen mehrere Schwachstellen in CODESYS. Diese Fehler bestehen in mehreren Komponenten und Subsystemen wie dem Control, Development System oder dem SysDrv3S.sys-Treiber, unter anderem aufgrund mehrerer sicherheitsrelevanter Probleme wie einer OS-Befehlsinjektion, einem Out-of-bounds-Write oder einer unzul\u00e4ssigen Einschr\u00e4nkung von Authentifizierungsversuchen. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuf\u00fchren, Sicherheitsma\u00dfnahmen zu umgehen, einen Denial-of-Service-Zustand auszul\u00f6sen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren oder Brute-Force-Angriffe durchzuf\u00fchren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion oder eine Anmeldung, um erfolgreich ausgenutzt zu werden."
        }
      ],
      "product_status": {
        "known_affected": [
          "T034337",
          "T040044"
        ]
      },
      "release_date": "2024-04-21T22:00:00.000+00:00",
      "title": "CVE-2023-6357"
    }
  ]
}