IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2021-159-02 — PowerLogic PM5500 and PowerLogic PM8ECC

CRITICAL
CVSS 9.8
Date 2026-10-16T20:33:05+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification > 08-Jun-21 (12-Nov-24) Document Reference Number – SEVD-2021-159-02 (v2.0.0) Page 1 of 5 ## PowerLogic PM5500 and PowerLogic PM8ECC 8 June 2021 (12 November 2024) ## Overview Schneider Electric is aware of a vulnerability in its PowerLogic PM55xx and PowerLogic PM8ECC products. The PowerLogic PM55xx products are power metering devices. The PowerLogic PM8ECC product is an ethernet communication module. Failure to apply the mitigations or remediations provided below may risk elevation of privileges, which could result in loss of control of the affected device. Update November 2024: Remediation is now available for PM5562. ## Affected Products and Versions CVE Product Version CVE-2021-22763 CVE-2021-22764 PM5560 Versions prior to v2.7.8 PM5561 Versions prior to v10.7.3 PM5562 v2.5.4 and prior PM5563 Versions prior to v2.7.8 CVE-2021-22763 PM8ECC All versions ## Vulnerability Details CVE ID: CVE-2021-22763 CVSS v3.1 Base Score 8.1 | High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists that could allow an attacker administrator level access to a device. CVE ID: CVE-2021-22764 CVSS v3.1 Base Score 5.3 | Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CWE-287: Improper Authentication vulnerability exists that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request. Schneider Electric Security Notification > 08-Jun-21 (12-Nov-24) Document Reference Number – SEVD-2021-159-02 (v2.0.0) Page 2 of 5

// Vulnerabilities (2)

CVE ID CVSS Score Severity Description
CVE-2021-22764 9.8 high
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.
CVE-2021-22763 9.8 high
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.

// Remediations (4)

Patch: Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilitie
Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-and-control - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
Patch: Version 10.7.3 of the PowerLogic PM5561 firmware includes fixes for these vulnerabilities. The vers
Version 10.7.3 of the PowerLogic PM5561 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-andcontrol#software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
Patch: PowerLogic PM8ECC has reached end of service and is no longer supported. Customers should immediate
PowerLogic PM8ECC has reached end of service and is no longer supported. Customers should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level once commissioning is complete to reduce the risk of exposure. Additionally, Customers should ensure the General security Recommendations listed below are in place.
Patch: Version 4.3.5 of the PowerLogic PM5562 firmware includes fixes for these vulnerabilities. The versi
Version 4.3.5 of the PowerLogic PM5562 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000/12146169702-basic-multifunction-metering/?selectednode-id=12146169702&N=brand=se%26countrycode=UK%26language-code=en%26node-id=12146169702 - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.

// References