// Description
Schneider Electric Security Notification
9-Mar-21 (15-Mar-21) Document Reference Number – SEVD-2021 -068-03 V2.0 Page 1 of 5
## PowerLogic ION8650 / ION8800 / ION7x50 / ION7700/73xx / ION83xx/84xx/85xx/8600 Power Meters (V2.0)
9 March 2021 (15 March 2021)
# Overview
Schneider Electric is aware of a vulnerability in its PowerLogic ION8650, ION8800, ION7x50, ION7700/73xx, and ION83xx/84xx/85xx/8600 products.
The PowerLogic metering products are revenue and power quality meters for utility and industrial electrical network monitoring.
Failure to apply the mitigations/remediations provided below may risk meter reboot, which could result in unintended device behavior.
March 2021 update : Affected product reference 'ION7650' changed to 'ION7x50' to encompass all affected product model references in this model series
# Affected Products and Versions
Product Version
ION8650 All versions prior to V4.40.1
ION8800 All versions prior to V372
ION7x50 (Hardware rev. 4 or earlier*) All versions prior to V376
ION7x50 (Hardware rev. 5*) All versions prior to V416
ION7700/73xx All versions
ION83xx/84xx/85xx/8600 All versions
*For details regarding how to determine hardware version, please refer to:
https://www.se.com/ww/en/faqs/FA328667/
# Vulnerability Details
CVE ID: CVE-2021-22713
CVSS v3.0 Base Score 7.5 | High | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
A CWE-119: Improper restriction of operations within the bounds of a memory buffer vulnerability exists that could cause the meter to reboot. Schneider Electric Security Notification
9-Mar-21 (15-Mar-21) Document Reference Number – SEVD-2021 -068-03 V2.0 Page 2 of 5
# Remediation
Affected Product & Version Remediation
ION8650
All versions prior to V4.40.1
V4.40.1 (released 4 January 2021) of the PowerLogic ION8650 firmware includes a fix for this vulnerability. The version update files are available for download here: