Schneider Faces Product Bugs

Thursday, January 17, 2013 @ 08:01 PM gHale

There is a public report concerning multiple vulnerabilities in multiple other Schneider Electric Products, according to a report on ICS-CERT.

These vulnerabilities released by Arthur Gervais at the Digital Bond SCADA Security Scientific Symposium (S4) conference. ICS-CERT notified Schneider of the report and asked the vendor to confirm the vulnerabilities and identify mitigations. ICS-CERT issued this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cyber security attacks.

Schneider Updates SESU Vulnerability
Brute Force Tool Targets Siemens S7
Mitigations for CoDeSys Toolkit
SpecView Mitigates SCADA/HMI Bug

Schneider is now aware of the remotely exploitable vulnerabilities in these products:
• The BMX NOE 0110 product has an unauthenticated SOAP/HTTP interface vulnerability, which could lead to remote code execution.
• Modicon M340 has a TCP connection resource exhaustion and a cross site request forgery that could lead to a denial of service (DoS) and unauthorized access.
• Magelis XBT has a HMI 6001/TCP hard coded credentials vulnerability, which could lead to loss of integrity

ICS-CERT is coordinating with the vendor and security researcher to identify mitigations.

One Response to “Schneider Faces Product Bugs”

Leave a Reply

You must be logged in to post a comment.