CVE-2021-22703 HIGH

Published: 2021-02-19 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device.

Additional Descriptions (1)

Una CWE-319: Se presenta una vulnerabilidad de transmisión de información confidencial en texto sin cifrar en PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 y PM800 (consulte la notificación para las versiones afectadas), que podría causar una divulgación de las credenciales del usuario cuando un actor malicioso intercepta el tráfico de red HTTP entre un usuario y el dispositivo

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-319

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	powerlogic_ion7400_firmware	*	<built-in method update of dict object at 0x738c08ae6980>	Operating System
schneider-electric	powerlogic_ion7650_firmware	*	<built-in method update of dict object at 0x738c09330c00>	Operating System
schneider-electric	powerlogic_ion8600_firmware	*	<built-in method update of dict object at 0x738c092ad600>	Operating System
schneider-electric	powerlogic_ion8650_firmware	*	<built-in method update of dict object at 0x738c0911f500>	Operating System
schneider-electric	powerlogic_ion8800_firmware	*	<built-in method update of dict object at 0x738ca047ee40>	Operating System
schneider-electric	powerlogic_ion9000_firmware	*	<built-in method update of dict object at 0x738c0933a4c0>	Operating System
schneider-electric	powerlogic_pm8000_firmware	*	<built-in method update of dict object at 0x738c09331140>	Operating System
schneider-electric	powerlogic_ion8300_firmware	*	<built-in method update of dict object at 0x738c0a2cac00>	Operating System
schneider-electric	powerlogic_ion8400_firmware	*	<built-in method update of dict object at 0x738c093302c0>	Operating System
schneider-electric	powerlogic_ion8500_firmware	*	<built-in method update of dict object at 0x738ca047c080>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7650_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7650:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8600_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8600:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8650_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8650:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8800_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8800:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion9000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion9000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm8000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm8000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8300_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8300:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8500_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8500:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2021-040-01/
Source: [email protected]

Mitigation Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2021-040-01/
Source: af854a3a-2127-422b-91ae-364da2661108

Mitigation Vendor Advisory