CVE-2022-46680 CRITICAL

Published: 2023-05-22 | Last Modified: 2024-11-21 | Status: Modified

Description

A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denial of service, or modification of data if an attacker is able to intercept network traffic.

CVSS Metrics

Base Score: 9.8 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	HIGH
Integrity Impact	HIGH
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 5.9

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-319

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	powerlogic_ion9000_firmware	*	<built-in method update of dict object at 0x7e60bb885900>	Operating System
schneider-electric	powerlogic_ion7400_firmware	*	<built-in method update of dict object at 0x7e60bb887040>	Operating System
schneider-electric	powerlogic_pm8000_firmware	*	<built-in method update of dict object at 0x7e60bb8864c0>	Operating System
schneider-electric	powerlogic_ion8650_firmware	-	<built-in method update of dict object at 0x7e60eb226e80>	Operating System
schneider-electric	powerlogic_ion8800_firmware	-	<built-in method update of dict object at 0x7e60bb8863c0>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion9000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion9000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion7400_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion7400:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm8000_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm8000:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8650_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8650:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_ion8800_firmware:-:::::::*`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_ion8800:-:::::::*`

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-129-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-129-03.pdf
Source: [email protected]

Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-129-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-129-03.pdf
Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory