CVE-2021-22703 HIGH

Published: 2021-02-19 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device.

Additional Descriptions (1)

Una CWE-319: Se presenta una vulnerabilidad de transmisión de información confidencial en texto sin cifrar en PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 y PM800 (consulte la notificación para las versiones afectadas), que podría causar una divulgación de las credenciales del usuario cuando un actor malicioso intercepta el tráfico de red HTTP entre un usuario y el dispositivo

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	NONE
Availability Impact	NONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-319

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	powerlogic_ion7400_firmware	*	<built-in method update of dict object at 0x7e60bae486c0>	Operating System
schneider-electric	powerlogic_ion7650_firmware	*	<built-in method update of dict object at 0x7e60a88a9040>	Operating System
schneider-electric	powerlogic_ion8600_firmware	*	<built-in method update of dict object at 0x7e60bae4a180>	Operating System
schneider-electric	powerlogic_ion8650_firmware	*	<built-in method update of dict object at 0x7e6100e8b380>	Operating System
schneider-electric	powerlogic_ion8800_firmware	*	<built-in method update of dict object at 0x7e60bae4bd40>	Operating System
schneider-electric	powerlogic_ion9000_firmware	*	<built-in method update of dict object at 0x7e60a8a54c80>	Operating System
schneider-electric	powerlogic_pm8000_firmware	*	<built-in method update of dict object at 0x7e6100e89300>	Operating System
schneider-electric	powerlogic_ion8300_firmware	*	<built-in method update of dict object at 0x7e60a8a54240>	Operating System
schneider-electric	powerlogic_ion8400_firmware	*	<built-in method update of dict object at 0x7e60a8a55900>	Operating System
schneider-electric	powerlogic_ion8500_firmware	*	<built-in method update of dict object at 0x7e60bae4bec0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7650_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7650:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8600_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8600:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8650_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8650:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8800_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8800:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion9000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion9000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm8000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm8000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8300_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8300:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8500_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8500:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2021-040-01/
Source: [email protected]

Mitigation Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2021-040-01/
Source: af854a3a-2127-422b-91ae-364da2661108

Mitigation Vendor Advisory