Vulnerabilites related to schneider-electric - powerlogic_pm5560_firmware
cve-2021-22763
Vulnerability from cvelistv5
Published
2021-06-11 15:40
Modified
2024-11-24 14:32
Severity ?
Summary
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.
References
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdfx_refsource_MISC
Impacted products
Vendor Product Version
n/a PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) Version: PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation)
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:51:07.371Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation)",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation)",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<p>A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.</p>",
                  },
               ],
               value: "A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-640",
                     description: "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-24T14:32:21.954Z",
            orgId: "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
            shortName: "schneider",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cybersecurity@schneider-electric.com",
               ID: "CVE-2021-22763",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation)",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02,http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
                     refsource: "MISC",
                     url: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02,http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
      assignerShortName: "schneider",
      cveId: "CVE-2021-22763",
      datePublished: "2021-06-11T15:40:47",
      dateReserved: "2021-01-06T00:00:00",
      dateUpdated: "2024-11-24T14:32:21.954Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2018-7795
Vulnerability from cvelistv5
Published
2018-08-29 20:00
Modified
2024-09-16 17:03
Severity ?
Summary
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.
References
https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/x_refsource_CONFIRM
http://www.securityfocus.com/bid/105170vdb-entry, x_refsource_BID
https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03x_refsource_MISC
Impacted products
Vendor Product Version
Schneider Electric SE PowerLogic - PM5560 prior to FW version 2.5.4 Version: PowerLogic - PM5560 prior to FW version 2.5.4
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T06:37:59.640Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/",
               },
               {
                  name: "105170",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105170",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "PowerLogic - PM5560 prior to FW version 2.5.4",
               vendor: "Schneider Electric SE",
               versions: [
                  {
                     status: "affected",
                     version: "PowerLogic - PM5560 prior to FW version 2.5.4",
                  },
               ],
            },
         ],
         datePublic: "2018-08-15T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Cross Protocol Injection",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2018-08-30T19:57:02",
            orgId: "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
            shortName: "schneider",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/",
            },
            {
               name: "105170",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105170",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cybersecurity@schneider-electric.com",
               DATE_PUBLIC: "2018-08-15T00:00:00",
               ID: "CVE-2018-7795",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PowerLogic - PM5560 prior to FW version 2.5.4",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "PowerLogic - PM5560 prior to FW version 2.5.4",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Schneider Electric SE",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Cross Protocol Injection",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/",
                     refsource: "CONFIRM",
                     url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/",
                  },
                  {
                     name: "105170",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105170",
                  },
                  {
                     name: "https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03",
                     refsource: "MISC",
                     url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
      assignerShortName: "schneider",
      cveId: "CVE-2018-7795",
      datePublished: "2018-08-29T20:00:00Z",
      dateReserved: "2018-03-08T00:00:00",
      dateUpdated: "2024-09-16T17:03:52.342Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

cve-2021-22764
Vulnerability from cvelistv5
Published
2021-06-11 15:40
Modified
2024-11-24 14:41
Severity ?
Summary
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.
References
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdfx_refsource_MISC
Impacted products
Vendor Product Version
n/a PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation) Version: PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation)
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-03T18:51:07.316Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               defaultStatus: "unaffected",
               product: "PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation)",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation)",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               supportingMedia: [
                  {
                     base64: false,
                     type: "text/html",
                     value: "<p>A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.</p>",
                  },
               ],
               value: "A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-287",
                     description: "CWE-287: Improper Authentication",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-11-24T14:41:33.312Z",
            orgId: "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
            shortName: "schneider",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf",
            },
         ],
         source: {
            discovery: "UNKNOWN",
         },
         x_generator: {
            engine: "Vulnogram 0.2.0",
         },
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cybersecurity@schneider-electric.com",
               ID: "CVE-2021-22764",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "PowerLogic PM55xx, PowerLogic EGX100, and PowerLogic EGX300 (see security notification for version infromation)",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-287: Improper Authentication",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02,http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
                     refsource: "MISC",
                     url: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02,http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
      assignerShortName: "schneider",
      cveId: "CVE-2021-22764",
      datePublished: "2021-06-11T15:40:47",
      dateReserved: "2021-01-06T00:00:00",
      dateUpdated: "2024-11-24T14:41:33.312Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

Vulnerability from fkie_nvd
Published
2018-08-29 20:29
Modified
2024-11-21 04:12
Severity ?
6.1 (Medium) - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.
References
cybersecurity@se.comhttp://www.securityfocus.com/bid/105170Third Party Advisory, VDB Entry
cybersecurity@se.comhttps://ics-cert.us-cert.gov/advisories/ICSA-18-240-03Mitigation, Third Party Advisory, US Government Resource
cybersecurity@se.comhttps://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/Mitigation, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/105170Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03Mitigation, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/Mitigation, Vendor Advisory
Impacted products
Vendor Product Version
schneider-electric powerlogic_pm5560_firmware *
schneider-electric powerlogic_pm5560 -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5560_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "A237BEC6-C940-49B8-B39B-E3C6DF9EAA7D",
                     versionEndExcluding: "2.5.4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5560:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6DDB1B76-3862-462E-B55D-875EBE508B92",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.",
      },
      {
         lang: "es",
         value: "Existe una vulnerabilidad de inyección de protocolos cruzados en el producto PowerLogic, de Schneider Electric (PM5560 anteriores a la versión de firmware 2.5.4). La vulnerabilidad hace que el producto sea susceptible a un ataque de Cross-Site Scripting (XSS) en su navegador web. Las entradas de usuario pueden manipularse para provocar la ejecución de código JavaScript.",
      },
   ],
   id: "CVE-2018-7795",
   lastModified: "2024-11-21T04:12:45.000",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "MEDIUM",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "NONE",
               baseScore: 4.3,
               confidentialityImpact: "NONE",
               integrityImpact: "PARTIAL",
               vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N",
               version: "2.0",
            },
            exploitabilityScore: 8.6,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: true,
         },
      ],
      cvssMetricV30: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "NONE",
               baseScore: 6.1,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "LOW",
               integrityImpact: "LOW",
               privilegesRequired: "NONE",
               scope: "CHANGED",
               userInteraction: "REQUIRED",
               vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
               version: "3.0",
            },
            exploitabilityScore: 2.8,
            impactScore: 2.7,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2018-08-29T20:29:00.437",
   references: [
      {
         source: "cybersecurity@se.com",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/105170",
      },
      {
         source: "cybersecurity@se.com",
         tags: [
            "Mitigation",
            "Third Party Advisory",
            "US Government Resource",
         ],
         url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03",
      },
      {
         source: "cybersecurity@se.com",
         tags: [
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Third Party Advisory",
            "VDB Entry",
         ],
         url: "http://www.securityfocus.com/bid/105170",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mitigation",
            "Third Party Advisory",
            "US Government Resource",
         ],
         url: "https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         tags: [
            "Mitigation",
            "Vendor Advisory",
         ],
         url: "https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/",
      },
   ],
   sourceIdentifier: "cybersecurity@se.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-79",
            },
         ],
         source: "nvd@nist.gov",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-06-11 16:15
Modified
2024-11-24 15:15
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.
References
cybersecurity@se.comhttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf
af854a3a-2127-422b-91ae-364da2661108http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03
Impacted products
Vendor Product Version
schneider-electric powerlogic_pm5560_firmware *
schneider-electric powerlogic_pm5560 -
schneider-electric powerlogic_pm5561_firmware *
schneider-electric powerlogic_pm5561 -
schneider-electric powerlogic_pm5562_firmware *
schneider-electric powerlogic_pm5562 -
schneider-electric powerlogic_pm5563_firmware *
schneider-electric powerlogic_pm5563 -
schneider-electric powerlogic_pm8ecc_firmware *
schneider-electric powerlogic_pm8ecc -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5560_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0F8EC9ED-1E27-40B8-84A8-F66BC9FD0803",
                     versionEndExcluding: "2.7.8",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5560:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6DDB1B76-3862-462E-B55D-875EBE508B92",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5561_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "EE3EFC50-39EA-4029-9713-9D191357DD29",
                     versionEndExcluding: "10.7.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5561:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "00D6C9E0-7DB3-4742-86F0-3430E99D1B1D",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5562_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FDBB46A2-4EAD-41DA-AC02-5E985EB755A1",
                     versionEndIncluding: "2.5.4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5562:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "55D7896E-3EFA-4632-B0D2-273084D56936",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5563_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "4E870589-0ADF-4B76-89CF-2D36F5C61CF0",
                     versionEndExcluding: "2.7.8",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5563:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5D4C9C4-C258-453B-85E4-893978D6C499",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm8ecc_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "064A8AD3-3657-4E66-8A7E-397DAF03BC96",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm8ecc:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "38BF2D7A-492B-4A0C-A841-A245C5657192",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.",
      },
      {
         lang: "es",
         value: "Un CWE-640: Se presenta un Mecanismo Débil de Recuperación de Contraseñas para Contraseñas Olvidadas en PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 y PowerLogic EGX300 (véase la notificación de seguridad para obtener información sobre la versión) que podría permitir a un atacante el acceso a nivel de administrador a un dispositivo",
      },
   ],
   id: "CVE-2021-22763",
   lastModified: "2024-11-24T15:15:04.450",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "HIGH",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "COMPLETE",
               baseScore: 10,
               confidentialityImpact: "COMPLETE",
               integrityImpact: "COMPLETE",
               vectorString: "AV:N/AC:L/Au:N/C:C/I:C/A:C",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 10,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "HIGH",
               baseScore: 9.8,
               baseSeverity: "CRITICAL",
               confidentialityImpact: "HIGH",
               integrityImpact: "HIGH",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 5.9,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-06-11T16:15:10.320",
   references: [
      {
         source: "cybersecurity@se.com",
         url: "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
      },
   ],
   sourceIdentifier: "cybersecurity@se.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-640",
            },
         ],
         source: "cybersecurity@se.com",
         type: "Primary",
      },
   ],
}

Vulnerability from fkie_nvd
Published
2021-06-11 16:15
Modified
2024-11-24 15:15
Severity ?
5.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Summary
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.
References
cybersecurity@se.comhttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf
af854a3a-2127-422b-91ae-364da2661108http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03
Impacted products
Vendor Product Version
schneider-electric powerlogic_pm5560_firmware *
schneider-electric powerlogic_pm5560 -
schneider-electric powerlogic_pm5561_firmware *
schneider-electric powerlogic_pm5561 -
schneider-electric powerlogic_pm5562_firmware *
schneider-electric powerlogic_pm5562 -
schneider-electric powerlogic_pm5563_firmware *
schneider-electric powerlogic_pm5563 -


To clipboard 

{
   configurations: [
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5560_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "0F8EC9ED-1E27-40B8-84A8-F66BC9FD0803",
                     versionEndExcluding: "2.7.8",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5560:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "6DDB1B76-3862-462E-B55D-875EBE508B92",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5561_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "EE3EFC50-39EA-4029-9713-9D191357DD29",
                     versionEndExcluding: "10.7.3",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5561:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "00D6C9E0-7DB3-4742-86F0-3430E99D1B1D",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5562_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "FDBB46A2-4EAD-41DA-AC02-5E985EB755A1",
                     versionEndIncluding: "2.5.4",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5562:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "55D7896E-3EFA-4632-B0D2-273084D56936",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
      {
         nodes: [
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:o:schneider-electric:powerlogic_pm5563_firmware:*:*:*:*:*:*:*:*",
                     matchCriteriaId: "4E870589-0ADF-4B76-89CF-2D36F5C61CF0",
                     versionEndExcluding: "2.7.8",
                     vulnerable: true,
                  },
               ],
               negate: false,
               operator: "OR",
            },
            {
               cpeMatch: [
                  {
                     criteria: "cpe:2.3:h:schneider-electric:powerlogic_pm5563:-:*:*:*:*:*:*:*",
                     matchCriteriaId: "C5D4C9C4-C258-453B-85E4-893978D6C499",
                     vulnerable: false,
                  },
               ],
               negate: false,
               operator: "OR",
            },
         ],
         operator: "AND",
      },
   ],
   cveTags: [],
   descriptions: [
      {
         lang: "en",
         value: "A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.",
      },
      {
         lang: "es",
         value: "Un CWE-287: Se presenta una vulnerabilidad de autenticación inapropiada en PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 y PowerLogic EGX300 (véase la notificación de seguridad para obtener información sobre la versión) que podría causar la pérdida de conectividad con el dispositivo por medio del protocolo Modbus TCP cuando un atacante envía una petición HTTP especialmente diseñada",
      },
   ],
   id: "CVE-2021-22764",
   lastModified: "2024-11-24T15:15:04.637",
   metrics: {
      cvssMetricV2: [
         {
            acInsufInfo: false,
            baseSeverity: "MEDIUM",
            cvssData: {
               accessComplexity: "LOW",
               accessVector: "NETWORK",
               authentication: "NONE",
               availabilityImpact: "PARTIAL",
               baseScore: 5,
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               vectorString: "AV:N/AC:L/Au:N/C:N/I:N/A:P",
               version: "2.0",
            },
            exploitabilityScore: 10,
            impactScore: 2.9,
            obtainAllPrivilege: false,
            obtainOtherPrivilege: false,
            obtainUserPrivilege: false,
            source: "nvd@nist.gov",
            type: "Primary",
            userInteractionRequired: false,
         },
      ],
      cvssMetricV31: [
         {
            cvssData: {
               attackComplexity: "LOW",
               attackVector: "NETWORK",
               availabilityImpact: "LOW",
               baseScore: 5.3,
               baseSeverity: "MEDIUM",
               confidentialityImpact: "NONE",
               integrityImpact: "NONE",
               privilegesRequired: "NONE",
               scope: "UNCHANGED",
               userInteraction: "NONE",
               vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
               version: "3.1",
            },
            exploitabilityScore: 3.9,
            impactScore: 1.4,
            source: "nvd@nist.gov",
            type: "Primary",
         },
      ],
   },
   published: "2021-06-11T16:15:10.390",
   references: [
      {
         source: "cybersecurity@se.com",
         url: "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf",
      },
      {
         source: "af854a3a-2127-422b-91ae-364da2661108",
         url: "http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03",
      },
   ],
   sourceIdentifier: "cybersecurity@se.com",
   vulnStatus: "Modified",
   weaknesses: [
      {
         description: [
            {
               lang: "en",
               value: "CWE-287",
            },
         ],
         source: "cybersecurity@se.com",
         type: "Primary",
      },
   ],
}