Vendor profile
Schneider Electric
Modicon controllers speaking Modbus TCP to SCADA on 502/TCP, with Control Expert engineering riding UMAS inside that same Modbus session; Geo SCADA Expert polling SCADAPack RTUs over DNP3 across radio and cellular telemetry; Triconex sitting as an independent SIL-rated safety layer with TriStation engineering on a dedicated host; and PowerLogic / Easergy devices reporting on the electrical network.
PLCSCADASafety systemsRTU / telemetryPower managementBuilding automationDrives
Controllers
Modicon M580 ePACModicon M340Modicon M241 / M251Modicon Quantum and Premium (legacy)Modicon TSX (end of life)
Safety
Triconex Tricon / Trident / TriStation 1131Modicon M580 Safety (S-variants)Triconex Safety View
RTU / telemetry
SCADAPack 47x / 57xRealflo flow computersTrio radios
Software
EcoStruxure Control Expert (Unity Pro)EcoStruxure Machine ExpertEcoStruxure Geo SCADA Expert (ClearSCADA)Wonderware / AVEVA System Platform (associated)
Power / electrical
PowerLogic ION metersEasergy P3 / T300 protection and RTUsMasterpact / Micrologic trip unitsEcoStruxure Power Monitoring Expert
Building / drives
EcoStruxure Building Operation and Automation ServerAltivar variable speed drivesSpaceLogic controllers
Defensive considerations
- Treat 502/TCP reachability as a designed conduit, not a default — and remember Modbus write and UMAS engineering share that single port, so an allow rule for 'read-only SCADA' also permits programming unless you inspect function codes
- Inspect for Modbus function code 90 (0x5A) — that is UMAS, Schneider's engineering protocol; download, mode change and reservation commands all ride inside it and a port-only rule will never see them
- Enable Control Expert application password and program-download protection on M580/M340, and keep the memory-protect input wired where the platform provides one
- Keep Triconex keyswitches in RUN/PROTECTED outside change windows, alarm on any TriStation connection, and treat TRITON as the proof case: the attackers reached the SIS because the safety host was reachable and the key was in PROGRAM
- Put the TriStation engineering host on a dedicated, isolated network with no email, browsing or shared credentials with the DCS
- Baseline Geo SCADA Expert user accounts, WebX access and outstation configuration; the SCADA server is the single point that can command every remote site
- Harden telemetry to SCADAPack RTUs — DNP3 Secure Authentication where supported, and no plain internet-facing cellular endpoints at unstaffed sites
- Alarm on Modicon CPU mode changes and on reservation/unreserve sequences in UMAS, which are the normal precursors to a download
- Inventory Quantum, Premium and TSX units with no fix path and give them compensating segmentation and monitoring
- Track Schneider security notifications by product range — advisories often affect Control Expert or Geo SCADA rather than the controller itself
At a glance
HeadquartersFrance
Protocolsmodbus-tcp, modbus-rtu, umas, dnp3, iec-60870-5-104, iec-61850, bacnet-ip, opc-ua
IndustriesWater / Wastewater, Oil & Gas, Electric Power, Chemical, Building Automation, Manufacturing
Sources & further reading
This website is an independent educational and defensive cybersecurity resource and is not affiliated with the vendors referenced within it.