IM
IronMonkey Threat Research
‹ Back to ICS Advisories

PowerLogic Power Metering Products

HIGH
CVSS 7.5
Date 2026-10-16T20:41:09+00:00
Source schneider-electric
Published by Schneider Electric

// Description

Schneider Electric Security Notification 9-Feb-21 Document Reference Number – SEVD-2021 -040-01 Page 1 of 6 ## PowerLogic Power Metering Products 9 February 2021 # Overview Schneider Electric is aware of multiple vulnerabilities in its PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM8000 products. The PowerLogic metering products are revenue and power quality meters for utility and industrial electrical network monitoring. Failure to apply the mitigations/remediations provided below may risk disclosure of user credentials when using HTTP or Telnet protocol or cause a user to perform an unintended action on a target device when using HTTP, which could result in unintended device behavior. # Affected Products and Versions Product Version ION7400 All versions prior to V3.0.0 ION7650 All versions ION7700/73xx All versions. Note: Only affected by CVE-2021-22702 as these products do not support HTTP web functionality. ION83xx/84xx/85xx/8600 All versions. ION8650 V 4.31.2 and prior. ION8800 All versions ION9000 All versions prior to V3.0.0 PM8000 All versions prior to V3.0.0 # Vulnerability Details CVE ID: CVE-2021-22701 CVSS v3.0 Base Score 6.2 | Medium | CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:H A CWE-352: Cross-Site Request Forgery vulnerability exists that could cause a user to perform an unintended action on the target device when using the HTTP web interface. Schneider Electric Security Notification 9-Feb-21 Document Reference Number – SEVD-2021 -040-01 Page 2 of 6 CVE ID: CVE-2021-22702 CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic between a user and the device. CVE ID: CVE-2021-22703

// Vulnerabilities (3)

CVE ID CVSS Score Severity Description
CVE-2021-22701 7.5 medium
A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause a user to perform an unintended action on the target device when using the HTTP web interface.
CVE-2021-22702 7.5 medium
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic between a user and the device.
CVE-2021-22703 7.5 medium
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device.

// References