IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2025-014-08 — PowerLogic™ HDPM6000 High-Density Metering System

HIGH
CVSS 8.8
Date 2026-10-16T20:32:47+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 14-Jan-25 Document Reference Number – SEVD-2025-014-08 Page 1 of 4 # PowerLogic™ HDPM6000 High-Density Metering System 14 January 2025 ## Overview Schneider Electric is aware of multiple vulnerabilities in its PowerLogic™ HDPM6000 High-Density Metering System product. The HDPM6000 products are high-density, multi-circuit busway and panelboard power meters for cost and network management in large and critical power applications. Failure to apply the remediation provided below may risk a low privileged user gaining higher level access, which could allow for modification of system configuration parameters or an unauthenticated user causing data corruption or denial of service to the devices web interface via a specially crafted Modbus protocol write operation. ## Affected Products and Versions Product CVE-2024-10497 CVE-2024-10498 PowerLogic™ HDPM6000 Version v0.62.7 only Versions v0.62.7 and prior ## Vulnerability Details CVE ID: CVE-2024-10497 CVSS v3.1 Base Score 8.8 | High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS v4.0 Base Score 8.7 | High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CWE-639: Authorization Bypass Through User-Controlled Key vulnerability exists that could allow an authorized attacker to modify values outside those defined by their privileges (Elevation of Privileges) when the attacker sends modified HTTPS requests to the device. CVE ID: CVE-2024-10498 CVSS v3.1 Base Score 6.5 | Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L CVSS v4.0 Base Score 6.9 | Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2024-10498 8.8 high
An improper restriction of operations within the bounds of a memory buffer vulnerability exists that could allow an unauthorized attacker to modify configuration values outside of the normal range when the attacker sends specific Modbus write packets to the device, which could result in invalid data or loss of web interface functionality.
CVE-2024-10497 8.8 high
An authorization bypass through user-controlled key vulnerability exists that could allow an authorized attacker to modify values outside those defined by their privileges (Elevation of Privileges) when the attacker sends modified HTTPS requests to the device.

// Remediations (4)

Patch: (CVE-2024-10498) Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior: Version v0.62.11
(CVE-2024-10498) Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior: Version v0.62.11 and newer of HDPM6000 includes a fix for these vulnerabilities and is available for download here. A device restart will occur as part of the firmware update process if conducted through the web user interface. If the upgrade is performed using the HDPM6000 Manager software, the device will need to be restarted manually to apply the update.
Mitigation: For more information, please see Schneider Electric's advisory.
For more information, please see Schneider Electric's advisory.
Patch: (CVE-2024-10498) Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior: If users choose
(CVE-2024-10498) Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior: If users choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Ensure that the device is not accessible via the Modbus protocol outside the local network segment by applying appropriate firewalls configuration and controls, and that access to the network segment is protected and controlled.
Mitigation: Schneider Electric has identified the following specific workarounds and mitigations users can apply
Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

// References