This may sound complacent, but your ELAU controller is rarely the thing that gets attacked but the line stops anyway.

That’s the pattern behind the most expensive industrial cyber incidents of the past year: Attackers bypassed security controls and accessed business IT. The unauthorized access halted production because the factory couldn’t run without the IT infrastructure and because nobody understood Sercos, cam profiles or a C400.

So the question most engineers reach for, “is my PacDrive secure?”, misses where the risk sits. The better question is: what can reach this controller, and what happens to the line when the network around it fails?

Why “it’s old and air-gapped” falls short

Legacy lines tend to rest on two comfortable assumptions. The controller is too obscure to target, and the machine network is separate from the office. The first is partly true; however, the second rarely survives an honest walk around the site.

At Jaguar Land Rover (JLR), a cyber incident in its internal IT environment led to an IT shutdown and halted global manufacturing [1]. The Cyber Monitoring Centre estimated that a week of halted production in the UK led to £108 million loss in fixed costs and lost profit [1]. It also warned that the estimate could be higher if operational technology had been significantly impacted [1].

FMCG isn’t exempt. Asahi’s ransomware attack forced Japan’s largest brewer to halt automated production and delivery at most of its 30 domestic sites [2]. Across the sector, manufacturing accounted for 27.7% of incidents IBM X-Force observed in 2025, the most targeted industry for the fifth year running [3].

The comfortable view also ignores how PacDrive lines actually connect. Engineering laptops travel between the office and the panel. Remote support often arrives through a modem or VPN somebody set up years ago. Line data feeds MES and shift reports. Each link earns its place, and each is also a route in.

A PacDrive estate, layer by layer

Exposure differs sharply between the two PacDrive generations. It differs again for the laptop that programs them.
Asset What it exposes Vendor fix available? What that leaves you with

Asset	What it exposes	Vendor fix available?	What that leaves you with
PacDrive M controller (C200, C400, C600)	VxWorks RTOS; Ethernet with TCP/IP, OPC, FTP, HTTP; teleservice via modem or web server [4]	No. Obsolete since December 2018 [5]	Isolation is the only defence
PacDrive 3 LMC Eco / Pro / Pro2	CODESYS V3 runtime; published flaws allow denial of service or remote code execution [6]	Yes, in firmware delivered with Machine Expert V2.2 [6]	Protected only once the firmware is actually updated
Engineering workstation	Windows host running SoMachine Motion or Machine Expert	Depends on OS; Windows 10 support ended 14 October 2025 [7]	Often the least-maintained PC on site

Three things follow from that table.
PacDrive M is frozen in time. Its controllers run VxWorks and support Ethernet with TCP/IP, OPC, FTP and HTTP, plus modem or web-server teleservice [4]. Schneider’s own tools can locate PacDrive M controllers over Ethernet using a network search function [8]. Anything else on that flat network can find them too. No public advisory names PacDrive M. That tells you nobody is assessing it any more, which reads very differently from “secure”.

PacDrive 3 has a fix route, and that creates a quieter risk. Schneider has confirmed CODESYS V3 runtime vulnerabilities that could cause denial of service or remote code execution on PacDrive controllers [6]. The fix ships as LMC Eco/Pro/Pro2 firmware delivered with Machine Expert V2.2 [6]. Updating needs a planned stop, a verified backup and an engineer confident enough to do it. On many sites those three never line up. Stores carries the same problem, because a spare LMC on old firmware brings the old vulnerability back into service.

The engineering workstation is often the weakest point of all. It connects to everything, it travels, and it runs whatever OS the tooling tolerated at installation. Windows 10’s final monthly security update was issued in October 2025 [7].

Map → Separate → Watch

OT security guidance runs to hundreds of pages. For a PacDrive estate, three stages carry most of the value.

Map. List every controller, drive generation, firmware version and IP address. Then record everything that talks to each one, including laptops, HMIs, MES links and remote access. The NCSC treats a complete, current view of your OT architecture as the foundation for every other security control [9]. You can’t separate what you haven’t found.

Separate. Group assets by risk, then control every path between the groups. IEC 62443 frames this as zones of assets sharing the same security requirements, and conduits carrying communications between them [10]. PacDrive M belongs in its own tightly bounded zone. NCSC guidance suggests obsolete systems may warrant administration only through local physical access [9]. Schneider’s baseline points the same way. Keep control networks behind firewalls, isolated from the business network, with controllers in locked cabinets and never left in Program mode [11]. Keep remote access to one known, documented route.

Watch. Log what crosses each boundary and keep the machine’s own event history. The NCSC principles end with logging and monitoring all connectivity, then establishing an isolation plan [9]. For a PacDrive line, that plan answers two practical questions. Can the line keep producing with IT cut off? And can your engineers still diagnose a fault if it can’t reach the office network?

Any monitoring tool has to pass the same test as every other connection. Machine Analyser reads PacDrive controller data read-only and sends it outbound only, with no inbound firewall ports. Sites with strict data rules can run it fully on-premise, so no data leaves the internal firewall [12]. That design stops a monitoring link from becoming a fresh way in.

Any monitoring tool has to pass the same test as every other connection. Machine Analyser reads PacDrive controller data read-only and sends it outbound only, with no inbound firewall ports. Sites with strict data rules can run it fully on-premise, so no data leaves the internal firewall [12]. That design stops a monitoring link from becoming a fresh way in.

Back to your estate

So, work out three things for your own lines. How many PacDrive controllers share a network with office PCs or unmanaged laptops? Which PacDrive 3 controllers, and which spares on the shelf, run firmware older than the current fix? And if IT shut down tomorrow, would your lines keep running, and could anyone still read a fault?

Most sites can answer the first question in an afternoon. The third one usually needs a meeting.

Nobody needs to understand Sercos II to stop a PacDrive line. They only need to reach the network it depends on.

Contact us at Machine Analyser to have a discussion about how to resolve these security issues for your legacy software.

FAQ

Is ELAU PacDrive M vulnerable to cyber attack?

PacDrive M has been obsolete since December 2018, so it receives no security updates. Its controllers support Ethernet with TCP/IP, FTP, HTTP and OPC, and some use modem teleservice. No public advisory names PacDrive M, but that reflects a lack of ongoing assessment. Treat it as unpatchable, keep it in its own network zone, and restrict every connection to a known, documented route.

Can PacDrive 3 controllers be patched against security vulnerabilities?

Yes. Schneider Electric has published fixes for CODESYS V3 runtime vulnerabilities affecting PacDrive 3 LMC Eco, Pro and Pro2 controllers, delivered as firmware with Machine Expert AsahiV2.2. The fix only protects a controller once it’s applied. Plan updates during a scheduled stop with a verified backup, and check that spare controllers in stores carry the same firmware.

Is an air gap enough to protect a legacy PLC?

Rarely, because true air gaps seldom survive daily operations. Engineering laptops, remote support links, MES connections and shared switches all bridge the gap over time. Map every connection first. Then apply zones and conduits under IEC 62443, so each path into the machine network is deliberate, controlled and logged rather than assumed.

Does condition monitoring create a new security risk on PacDrive lines?

Any new connection needs assessing, so it’s the right question to ask. Machine Analyser reads PacDrive controller data read-only, without writing to the controller or altering settings. Data flows outbound only, so no inbound firewall ports or listening services are needed. Sites with strict data governance can deploy it fully on-premise, keeping all data inside their own firewall.

What happens to a PacDrive line if IT systems go down?

It depends on how tightly the line is coupled to IT. Recent incidents at JLR and Asahi halted production after attacks on business systems, without the controllers themselves being compromised. Every site should test whether its PacDrive lines can keep running, and still be diagnosed, with IT cut off. The NCSC calls this an isolation plan.