CVE-2021-22701 MEDIUM

Published: 2021-02-19 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause a user to perform an unintended action on the target device when using the HTTP web interface.

Additional Descriptions (1)

Una CWE-352: Se presenta una vulnerabilidad de tipo Cross-Site Request Forgery en PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 y PM800 (consulte la notificación para las versiones afectadas), que podría causar que un usuario lleve a cabo una acción no deseada en el dispositivo de destino cuando se usa la interfaz web HTTP

CVSS Metrics

Base Score: 4.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	HIGH
User Interaction	REQUIRED
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	HIGH
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 0.9

Impact Score: 3.6

Base Score: 3.5 (LOW)

AV:N/AC:M/Au:S/C:N/I:P/A:N

Access Vector	NETWORK
Access Complexity	MEDIUM
Authentication	SINGLE
Confidentiality Impact	NONE
Integrity Impact	PARTIAL
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 6.8

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-352

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	powerlogic_ion7400_firmware	*	<built-in method update of dict object at 0x7e61109d4840>	Operating System
schneider-electric	powerlogic_ion7650_firmware	*	<built-in method update of dict object at 0x7e6110a56300>	Operating System
schneider-electric	powerlogic_ion8600_firmware	*	<built-in method update of dict object at 0x7e6110a56140>	Operating System
schneider-electric	powerlogic_ion8650_firmware	*	<built-in method update of dict object at 0x7e61109d5bc0>	Operating System
schneider-electric	powerlogic_ion8800_firmware	*	<built-in method update of dict object at 0x7e60e884fc40>	Operating System
schneider-electric	powerlogic_ion9000_firmware	*	<built-in method update of dict object at 0x7e60e884e4c0>	Operating System
schneider-electric	powerlogic_pm8000_firmware	*	<built-in method update of dict object at 0x7e60e8814300>	Operating System
schneider-electric	powerlogic_ion8300_firmware	*	<built-in method update of dict object at 0x7e60bae4ad80>	Operating System
schneider-electric	powerlogic_ion8400_firmware	*	<built-in method update of dict object at 0x7e60e86cfa80>	Operating System
schneider-electric	powerlogic_ion8500_firmware	*	<built-in method update of dict object at 0x7e60e884ce00>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7400:-:::::::*`
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7410:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7650_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7650:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8600_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8600:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8650_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8650:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8800_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8800:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion9000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion9000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm8000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm8000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8300_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8300:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8500_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8500:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2021-040-01/
Source: [email protected]

Mitigation Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2021-040-01/
Source: af854a3a-2127-422b-91ae-364da2661108

Mitigation Vendor Advisory