CVE-2021-22702
High
Description
A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION7700/73xx, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts Telnet network traffic between a user and the device.
SeverityHigh
CVSS7.5
Exploit probability—
ProductSchneider-electric Powerlogic Ion7400 Firmware
PublishedFeb 19, 2021
First seenFeb 19, 2021
Weakness typeCWE-319CWE-319
How to fix
Update
- schneider-electric powerlogic_ion7400_firmware3.0.0 or later
- schneider-electric powerlogic_ion9000_firmware3.0.0 or later
- schneider-electric powerlogic_pm8000_firmware3.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| schneider-electric powerlogic_ion7400_firmware | v < 3.0.0 | 3.0.0 |
| schneider-electric powerlogic_ion7650_firmware | No range specified | — |
| schneider-electric powerlogic_ion7700_firmware | No range specified | — |
| schneider-electric powerlogic_ion7300_firmware | No range specified | — |
| schneider-electric powerlogic_ion8600_firmware | No range specified | — |
| schneider-electric powerlogic_ion8650_firmware | v ≤ 4.31.2 | — |
| schneider-electric powerlogic_ion8800_firmware | No range specified | — |
| schneider-electric powerlogic_ion9000_firmware | v < 3.0.0 | 3.0.0 |
| schneider-electric powerlogic_pm8000_firmware | v < 3.0.0 | 3.0.0 |
| schneider-electric powerlogic_ion8300_firmware | No range specified | — |
| schneider-electric powerlogic_ion8400_firmware | No range specified | — |
| schneider-electric powerlogic_ion8500_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.