^{CVE-2021-22779:}Authentication Bypass Vulnerability in Schneider Electric Products Allows Unauthorized Controller Access

Overview

The vulnerability (CWE-290: Authentication Bypass by Spoofing) affects numerous Schneider Electric industrial control systems and software. Affected products include EcoStruxure Control Expert (all versions prior to V15.0 SP1, including all versions of Unity Pro), EcoStruxure Control Expert V15.0 SP1, EcoStruxure Process Expert (all versions, including all versions of EcoStruxure Hybrid DCS), SCADAPack RemoteConnect for x70 (all versions), Modicon M580 CPU (all versions - part numbers BMEP* and BMEH*), and Modicon M340 CPU (all versions - part numbers BMXP34*).

An attacker with network access to the affected systems could potentially spoof the Modbus communication channel between the engineering software and the controller. This could allow unauthorized access with both read and write capabilities to the controller, potentially enabling an attacker to view sensitive information or make unauthorized changes to industrial control systems.

Remediation

Users should implement the following mitigation strategies:

1. Update to the latest software versions as recommended by Schneider Electric
2. Implement network segmentation to isolate control system networks from other networks
3. Use secure remote access methods when remote access is required
4. Implement a firewall to block all unauthorized access
5. Follow Schneider Electric's specific security advisories and recommendations for each affected product
6. Monitor systems for unusual activity that could indicate exploitation attempts

For specific patch information and detailed remediation steps, refer to Schneider Electric's security advisory SEVD-2021-194-01.

References

1. Schneider Electric Security Advisory SEVD-2021-194-01: http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-194-01
2. MITRE CWE-290 (Authentication Bypass by Spoofing): https://cwe.mitre.org/data/definitions/290.html
3. ICS-CERT Advisory (if available)
4. Schneider Electric Product Security Portal: https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp