Schneider Electric PowerLogic PM8ECC Hard-coded Password Vulnerability
This CSAF advisory was extracted from unstructured data and may contain inaccuracies. If you notice any errors, please reach out to the designated contact at CISA CSAF: central@cisa.dhs.gov
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2016-5818US | critical9.8OT elevated | — | ||
An issue was discovered in Schneider Electric PowerLogic PM8ECC device 2.651 and older. Undocumented hard-coded credentials allow access to the device. | ||||
references
External citations — patches, advisories, analysis.
- ICS Advisory ICSA-16-292-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-16-292-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
remediations (1)
- MitigationPowerLogic PM8ECC
Schneider Electric recommends reducing the attack surface by turning off the web server. Turning off the web server will not allow the unintentional information to be disclosed. Schneider recommends users contact technical support at Schneider Electric for instructions to turn off the web server. A firmware upgrade to Version 2.651 may be required to enable this functionality.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan