IM
IronMonkey Threat Research
‹ Back to ICS Advisories

PowerLogic PM5300 Series

HIGH
CVSS 7.5
Date 2026-10-16T20:32:58+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 12-Nov-24 Document Reference Number – SEVD-2024 -317-01 Page 1 of 4 # PowerLogic PM5300 Series 12 November 2024 ## Overview Schneider Electric is aware of a vulnerability in its PowerLogic PM5300 series with ethernet functionality. PowerLogic PM5300 series offers a compact, versatile power meter for energy cost and basic network management applications. Failure to apply the remediation below may risk loss of communication to the device leading to a denial of service. ## Affected Products and Versions Product Version PowerLogic PM5320 Version 2.3.8 and prior PowerLogic PM5340 Version 2.3.8 and prior PowerLogic PM5341 Version 2.6.6 and prior Note – PM5310 and PM5330 are not impacted because they use serial communication infrastructure and do not have an Ethernet stack. ## Vulnerability Details CVE ID: CVE-2024-9409 CVSS v3.1 Base Score 7.5 | High | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS v4.0 Base Score 8.7 | High | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a large amount of IGMP packets is present in the network. The severity of vulnerabilities was calculated using the CVSS Base metrics for 4.0 (CVSS v4.0). CVSS v3.1 will be still evaluated until the adoption of CVSS v4.0 by the industry. The severity was calculated without incorporating the Temporal and Environmental metrics. Schneider Electric recommends that customers score the CVSS Environmental metrics, which are specific to end-user organizations, and consider factors such as the presence of mitigations in that environment. Environmental metrics may refine the relative severity posed by the vulnerabilities described in this document within a customer’s environment. Schneider Electric Security Notification

// Vulnerabilities (1)

CVE ID CVSS Score Severity Description
CVE-2024-9409 7.5 high
CVE-2024-9409. CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a large amount of IGMP packets is present in the network.

// Remediations (4)

Patch: Version 2.7.0 of PowerLogic PM5341 includes a fix for this vulnerability and is available for down
Version 2.7.0 of PowerLogic PM5341 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/METSEPM5341/pm5341-meter-ethernet-up-to31st-h-256k-2di-2do-35-alarms-mid/
Patch: Version 2.4.0 of PowerLogic PM5340 includes a fix for this vulnerability and is available for down
Version 2.4.0 of PowerLogic PM5340 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogicpm5340-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms
Patch: Version 2.4.0 of PowerLogic PM5320 includes a fix for this vulnerability and is available for down
Version 2.4.0 of PowerLogic PM5320 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/METSEPM5340/power-meter-powerlogicpm5340-ethernet-up-to-31st-harmonic-256kb-2di-2do-35-alarms
Mitigation: If customers choose not to apply the remediation provided above, they should immediately apply the f
If customers choose not to apply the remediation provided above, they should immediately apply the following steps to reduce the risk of exploit: 1. Enable IGMP Snooping: o Ensure that IGMP Snooping is enabled on the switch. This feature allows the switch to intelligently forward multicast traffic only to the necessary ports where interested hosts reside. It prevents unnecessary flooding of multicast traffic across all ports, thereby enhancing network efficiency and minimizing unnecessary load on network resources. 2. Configure VLAN Interface Settings: o Set up VLAN interface settings on the switch. It's important to have distinct configurations for each VLAN to ensure proper IGMP operation. 3. Multicast Filtering: o Use IGMP filtering to control the propagation of IGMP traffic through the network. This involves configuring filters on a switch virtual interface (SVI), per-port, or per-port per-VLAN basis. Multicast filtering helps manage IGMP snooping and controls multicast traffic forwarding effectively.

// References