Schneider Electric SE Vulnerabilities and Affected Products
Vulnerabilities associated with ClearSCADA.
Products
Clear product- U.Motion20 vulnerabilities
- Pelco Sarix Professional12 vulnerabilities
- Embedded Web Servers in all Modicon M340, Premium, Quantum PLCs and BMXNOR02008 vulnerabilities
- 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS4 vulnerabilities
- Citect Anywhere4 vulnerabilities
- IIoT Monitor 3.1.384 vulnerabilities
- Modicon M221, all references, all versions prior to firmware V1.6.2.04 vulnerabilities
- Modicon M5804 vulnerabilities
- PowerSCADA Anywhere4 vulnerabilities
- U.motion Builder4 vulnerabilities
- Eurotherm by Schneider Electric GUIcon V2.0 (Gold Build 683.0)3 vulnerabilities
- EVLink Parking v3.2.0-12_v1 and earlier3 vulnerabilities
- Modicon M3403 vulnerabilities
- Modicon M580, Modicon M340, Modicon Quantum, Modicon Premium (see security notification for specific versions)3 vulnerabilities
- Modicon Quantum3 vulnerabilities
- Pelco Sarix Professional V13 vulnerabilities
- Pelco VideoXpert Enterprise3 vulnerabilities
- Ampla MES2 vulnerabilities
- BMXNOR0200H Ethernet / Serial RTU module2 vulnerabilities
- ClearSCADA2 vulnerabilities
- Modicon Premium2 vulnerabilities
- Modicon Premium, Modicon Quantum, Modicon M340, BMXNOR02002 vulnerabilities
- SoMachine HVAC Programming Software2 vulnerabilities
- U.motion Server2 vulnerabilities
- Wiser for KNX2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2017-6021HIGH | In Schneider Electric ClearSCADA 2014 R1 (build 75.5210) and prior, 2014 R1.1 (build 75.5387) and prior, 2015 R1 (build 76.5648) and prior, and 2015 R2 (build 77.5882) and prior, an attacker with network access to the ClearSCADA server can send specially crafted sequences of commands and data packets to the ClearSCADA server that can cause the ClearSCADA server process and ClearSCADA communications driver processes to terminate. A CVSS v3 base score of 7.5 has been assigned; the CVSS vector stri… CWE-20May 14, 2018 | CVSS7.5v3.0 | EPSS1.69% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2017-9962HIGH | Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malformed requests can be sent to ClearSCADA client applications to cause unexpected behavior. Client applications affected include ViewX and the Server Icon. CWE-119Sep 25, 2017 | CVSS7.5v3.0 | EPSS1.03% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |