CVE-2021-22763 CRITICAL

Published: 2021-06-11 | Last Modified: 2026-05-29 | Status: Modified

Description

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.

Additional Descriptions (1)

Un CWE-640: Se presenta un Mecanismo Débil de Recuperación de Contraseñas para Contraseñas Olvidadas en PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 y PowerLogic EGX300 (véase la notificación de seguridad para obtener información sobre la versión) que podría permitir a un atacante el acceso a nivel de administrador a un dispositivo

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Base Score: 10.0 (HIGH)

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector	NETWORK
Access Complexity	LOW
Authentication	NONE
Confidentiality Impact	COMPLETE
Integrity Impact	COMPLETE
Availability Impact	COMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 10.0

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-640

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	powerlogic_pm5560_firmware	*	<built-in method update of dict object at 0x7634bc29de00>	Operating System
schneider-electric	powerlogic_pm5561_firmware	*	<built-in method update of dict object at 0x7634bc4c4580>	Operating System
schneider-electric	powerlogic_pm5562_firmware	*	<built-in method update of dict object at 0x763487f09d80>	Operating System
schneider-electric	powerlogic_pm5563_firmware	*	<built-in method update of dict object at 0x7634bc4c5fc0>	Operating System
schneider-electric	powerlogic_pm8ecc_firmware	*	<built-in method update of dict object at 0x7634bc4c6140>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm5560_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm5560:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm5561_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm5561:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm5562_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm5562:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm5563_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm5563:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm8ecc_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm8ecc:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf
Source: [email protected]
http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03
Source: af854a3a-2127-422b-91ae-364da2661108