CVE-2021-22714 CRITICAL

Published: 2021-03-11 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-119:Improper restriction of operations within the bounds of a memory buffer vulnerability exists in PowerLogic ION7400, PM8000 and ION9000 (All versions prior to V3.0.0), which could cause the meter to reboot or allow for remote code execution.

Additional Descriptions (1)

A CWE-119: se presenta una vulnerabilidad de Restricción Inapropiada de Operaciones dentro de los Límites de un Búfer de la Memoria en PowerLogic ION7400, PM8000 e ION9000 (todas las versiones anteriores a V3.0.0), lo que podría causar al medidor reiniciarse o permitir una ejecución de código remota

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 7.5 (HIGH)

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	PARTIAL
Integrity Impact	PARTIAL
Availability Impact	PARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 6.4

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-119

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	powerlogic_ion7400_firmware	*	<built-in method update of dict object at 0x7e60baa0a340>	Operating System
schneider-electric	powerlogic_pm8000_firmware	*	<built-in method update of dict object at 0x7e60bae0e480>	Operating System
schneider-electric	powerlogic_ion9000_firmware	*	<built-in method update of dict object at 0x7e60b81014c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm8000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm8000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion9000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion9000:-:::::::*`

References

https://www.se.com/ww/en/download/document/SEVD-2021-068-02
Source: [email protected]

Vendor Advisory
https://www.se.com/ww/en/download/document/SEVD-2021-068-02
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory