CERT-In Advisory
CIAD-2022-0025
Multiple Vulnerabilities in Schneider Electric Products
Original Issue Date: October 13, 2022
Severity Rating: High
Software Affected
The following Schneider Electric Products are affected:
- EcoStruxure Operator Terminal Expert ( version 3.3 Hotfix 1 or prior)
- Pro-face BLUE (version 3.3 Hotfix1 or prior)
- EcoStruxure Panel Server Box (PAS900) ( version 3.1.16 and prior)
- SAGE RTU C3414 CPU (Current) with optional ISaGRAF software versions prior to 6.6.10 (All firmware versions prior to C3414-500-S02K5_P5)
- SAGE RTU C3413, C3412 CPU (Obsolete CPUs) with optional ISaGRAF software versions prior to 6.6.10 (All firmware versions)
- EcoStruxure Power SCADA Operation 2020 (Version 2020 and 2020 CU1)
- EcoStruxure Power SCADA Operation 2020 R2 (Version 2020 R2 Prior to CU1)
- EcoStruxure Power Operation 2021 (Version 2021, 2021 CU1 and 2021 CU2)
Overview
Multiple vulnerabilities have been reported in Schneider Electric Products which could allow an attacker to elevate the privileges, execute malicious code remotely, view data, change settings, impact availability of the software, traverse the file system, overwrite existing files, create additional files and perform denial-of-service attack on the targeted system.
Description
These vulnerabilities include out-of-bounds write, path traversal, deserialization of untrusted data, improper verification of cryptographic signature, incorrect project conversion, buffer overflow, SQL injection and Improper Input Validation.
Successful exploitation of these vulnerabilities could allow an attacker to elevate the privileges, execute malicious code remotely, view data, change settings, impact availability of the software, traverse the file system, overwrite existing files, create additional files and perform denial-of-service attack on the targeted system.
Solution
Apply appropriate patches/ remediation as mentioned in the Schneider Security advisories:
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-284-01_EcoStruxure_Operator_Terminal_Expert_and_Pro-face_BLUE_Security_Notification.pdf&_ga=2.93179037.1844826123.1665562725-191116408.1665562725
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-284-03-SAGE_RTU_ISaGraf_Workbench_Security_Notification.pdf&_ga=2.107471234.1844826123.1665562725-191116408.1665562725
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-284-04-EcoStruxure_Power_Operation_and_EcoStruxure_Power_SCADA.pdf&_ga=2.107471234.1844826123.1665562725-191116408.1665562725
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-284-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-284-02-EcoStruxure_Panel_Server_Box_PAS900_Security_Notification.pdf&_ga=2.107471234.1844826123.1665562725-191116408.1665562725
Vendor Information
Schneider Electric
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
References
Schneider Electric
https://www.se.com/ww/en/work/support/cybersecurity/security-notifications.jsp
CVE Name
CVE-2022-2463
CVE-2022-2464
CVE-2022-2465
CVE-2022-22727
CVE-2022-30790
CVE-2022-30552
CVE-2022-41666
CVE-2022-41667
CVE-2022-41668
CVE-2022-41669
CVE-2022-41670
CVE-2022-41671
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|