CVE-2021-22763

CRITICAL

9.8

Description

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie6/11/2021

Derniere modification11/24/2024

Sourcenvd

Observations honeypot0

Produits affectes

schneider-electric:powerlogic_pm5560schneider-electric:powerlogic_pm5560_firmwareschneider-electric:powerlogic_pm5561schneider-electric:powerlogic_pm5561_firmwareschneider-electric:powerlogic_pm5562schneider-electric:powerlogic_pm5562_firmwareschneider-electric:powerlogic_pm5563schneider-electric:powerlogic_pm5563_firmwareschneider-electric:powerlogic_pm8eccschneider-electric:powerlogic_pm8ecc_firmware

Faiblesses (CWE)

CWE-640

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf(cybersecurity@se.com)

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.