PowerLogic ION7400 / PM8000 / ION9000 Power Meters

Schneider Electric Security Notification 9-Mar-21 Document Reference Number – SEVD-2021 -068-02 Page 1 of 4 ## PowerLogic ION7400 / PM8000 / ION9000 Power Meters 9 March 2021 # Overview Schneider Electric is aware of a vulnerability in its PowerLogic ION7400, PM8000 and ION9000 products. The PowerLogic metering products are revenue and power quality meters for utility and industrial electrical network monitoring. Failure to apply the mitigations/remediations provided below may risk meter reboot or remote code execution, which could result in unintended device behavior. # Affected Products and Versions Product Version ION7400 All versions prior to V3.0.0 ION9000 All versions prior to V3.0.0 PM8000 All versions prior to V3.0.0 # Vulnerability Details CVE ID: CVE-2021-22714 CVSS v3.0 Base Score 9.8 | Critical | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H A CWE-119: Improper restriction of operations within the bounds of a memory buffer vulnerability exists that could cause the meter to reboot or allow for remote code execution. # Remediation Affected Product & Version Remediation ION7400 All versions prior to V3.0.0 V3.0.0 (released 30 July 2020) of the PowerLogic ION7400 firmware includes a fix for this vulnerability. The version update files are available for download here: https://www.se.com/ww/en/download/document/ION7400_meter_FW_v0 03.000.000/ Note: There may be newer versions of the firmware available for download, please check the ION7400 product page on before upgrading. Schneider Electric Security Notification 9-Mar-21 Document Reference Number – SEVD-2021 -068-02 Page 2 of 4 ION9000 All versions prior to V3.0.0 V3.0.0 (released 30 July 2020) of the ION9000 firmware includes a fix for this vulnerability. The version update files are available for download here: available for download here: https://www.se.com/ww/en/download/document/ION9000_meter_FW_v0 03.000.000/