Jul 14, 2021 12:17:00

Remote code execution vulnerabilities found in Schneider Electric PLCs could affect industrial machinery around the world

It has been confirmed that the PLC of the product ' Modicon ' of the electric manufacturer Schneider Electric has a vulnerability that allows an attacker to bypass security and control it.

ModiPwn --Armis
https://www.armis.com/research/modipwn/

Modipwn vulnerability puts millions of building systems at risk

https://www.computerweekly.com/news/252503930/Modipwn-vulnerability-puts-millions-of-building-systems-at-risk

Researchers warn of unpatched remote code execution flaws in Schneider Electric industrial gear • The Register
https://www.theregister.com/2021/07/13/armis_schneider_electric_flaw/

According to security firm Armis , the discovered vulnerability, CVE-2021-22779, exploits a patch flaw in a patch that Schneider Electric distributed in 2018 and 2019 with partial modifications to address DoS attacks. After performing network access to Modicon's PLC, an attacker could bypass authentication and exploit Schneider Electric's protocol called UMAS to obtain a specific hash from the device's memory and execute code remotely. ..

Armis has been working with Schneider Electric since November 2020 to address the vulnerability, and in the process discovered this vulnerability. Armis said, 'Fixing fundamental design flaws in Modicon and UMAS will take time and may lead to new vulnerabilities in the future,' and will continue to work with Schneider Electric to address the issue. I showed my posture.

Schneider Electric announced that it will 'distribute patches by the end of 2021' and released

guidelines (PDF file) that provide models and versions affected by the vulnerability and advice on mitigating the potential impact. .. 'We would like to thank the independent security research institutes and work together to help protect users from vulnerabilities,' said Schneider Electric.