Threat Investigation
Request a demo

CVE-2022-32513

Critical

Description

A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the password. Affected Products: C-Bus Network Automation Controller - LSS5500NAC (Versions prior to V1.10.0), Wiser for C-Bus Automation Controller - LSS5500SHAC (Versions prior to V1.10.0), Clipsal C-Bus Network Automation Controller - 5500NAC (Versions prior to V1.10.0), Clipsal Wiser for C-Bus Automation Controller - 5500SHAC (Versions prior to V1.10.0), SpaceLogic C-Bus Network Automation Controller - 5500NAC2 (Versions prior to V1.10.0), SpaceLogic C-Bus Application Controller - 5500AC2 (Versions prior to V1.10.0)

SeverityCritical
CVSS9.8
Exploit probability—
ProductSchneider-electric 5500ac2 Firmware
PublishedJan 30, 2023
First seenJan 30, 2023
Weakness typeCWE-521CWE-521

How to fix

Update
  • schneider-electric 5500ac2_firmware1.11.0 or later
  • schneider-electric 5500nac_firmware1.11.0 or later
  • schneider-electric 5500nac2_firmware1.11.0 or later
  • schneider-electric 5500shac_firmware1.11.0 or later
  • schneider-electric lss5500nac_firmware1.11.0 or later
  • schneider-electric lss5500shac_firmware1.11.0 or later

Affected products

ProductAffected versionsFixed in
schneider-electric 5500ac2_firmwarev < 1.11.01.11.0
schneider-electric 5500nac_firmwarev < 1.11.01.11.0
schneider-electric 5500nac2_firmwarev < 1.11.01.11.0
schneider-electric 5500shac_firmwarev < 1.11.01.11.0
schneider-electric lss5500nac_firmwarev < 1.11.01.11.0
schneider-electric lss5500shac_firmwarev < 1.11.01.11.0

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.