Treck TCP/IP Ripple 20 Vulnerabilities Affecting Schneider Devices
Issue:
What Schneider Electric devices were affected by the Treck Inc. Ripple20 cyber vulnerabilities?
Product:
Industrial Automation Products
Energy Management Products
Uninterruptible Power Supply
Power Distribution Units
Battery Management
Automatic Transfer Switches
Environmental Monitoring Products
Cooling Products
*complete detailed list of products in the attachment
Environment:
Cybersecurity
Cause:
Treck Inc. publicly disclosed 19 vulnerabilities in its embedded TCP/IP stack, collectively known as Ripple20.
These vulnerabilities vary in severity, with several capable of enabling remote code execution. Other possible impacts include:
- Privilege escalation
- Denial of service
- Information leakage
These issues arise from flaws such as improper length handling, improper input validation, out‑of‑bounds read/write, integer overflows, double free, and others, as identified in federal advisories.
Resolution:
A list of Schneider Electric devices affected by the Ripple20 vulnerabilities is available in theattached document found under the Related tab.
Recommendation:
If you are using an older version of PME, consider upgrading to the latest version for improved protocol support and security. For assistance with integration or upgrades, contact Schneider Electric Technical Support at: pmo.support@se.com