Fixed as of:
Cabinet Controller c430 V1.15.2
Cabinet Controller c520 V1.15.2
Cabinet Controller c550 V1.15.2
Source: Lenze SE
Availability date: July 27, 2026
Reference to the official Cert@VDE advisory:
Further information on 'Lenze: Incorrect signature validation in the enable SSH routine' can be found in Advisory 'VDE-2026-077'.
Installing the patch:
Use the EASY Firmware Loader (part of EASY Starter) to load the firmware into the controller. If the firmware does not appear in the EASY Firmware Loader, check the EASY Package Manager to ensure you have downloaded all packages from the Lenze Package Server.
Dependencies:
The firmware can be installed on all Lenze controllers running an older firmware version.
Usage notes:
Use the EASY Starter, for example, to check the controller’s current firmware version in parameter 0x2000:004 (Device data: CU firmware version).
Risks if the patch is not applied:
Under certain circumstances, this could result in the confidentiality, integrity, and availability of the product no longer being guaranteed.
Description of the behavior:
The affected products belong to the Controller or Servo Drive product family and contain a vulnerability in a security-critical activation mechanism for service access. Under certain conditions, the signature verification of a file used for activation can be compromised, which could allow unauthorized access to the device. The vulnerability affects only the mechanism for enabling service access and does not affect the regular operation of the devices.
Affected Products:
Cabinet Controller c430
Cabinet Controller c520
Cabinet Controller c550
Short-term measures, recommendations, assessment:
Check to see if there is an activation file on the SD card, and delete it. In addition, it is recommended that you protect each access path with appropriate measures, such as physically securing access to the SD card, authorizing file transfers via PLC Designer (if supported by the respective product), authorizing file transfers via OPC UA (if supported by the respective product), and customizing the key for SFTP access.
