Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC
Overview Schneider Electric is aware of a vulnerability in its PowerLogic PM55xx and PowerLogic PM8ECC products. The PowerLogic PM55xx products are power metering devices. The PowerLogic PM8ECC product is an ethernet communication module. Failure to apply the mitigations or remediations provided below may risk elevation of privileges, which could result in loss of control of the affected device.
beschreibt (2)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-22764US | medium5.3 | — | ||
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infr… | ||||
| CVE-2021-22763US | critical9.8 | — | ||
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see securi… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- PowerLogic PM5500 and PowerLogic PM8ECC - SEVD-2021-159-02 CSAF Versionself
- PowerLogic PM5500 and PowerLogic PM8ECC - SEVD-2021-159-02 PDF Versionself
- ICS Advisory ICSA-24-331-01 JSONself
- Recommended Practicesexternal
- ICS Advisory ICSA-24-331-01 - Web Versionself
- Recommended Practicesexternal
- Recommended Practicesexternal
- Recommended Practicesexternal
Behebungen (10)
- BehobenPowerLogic PM5560
Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-and-control - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&parent-subcategory-id=4125&filter=business-2-building-automation-and-control#software-and-firmware - BehobenPowerLogic PM5560
Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-and-control - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&parent-subcategory-id=4125&filter=business-2-building-automation-and-control#software-and-firmware - BehobenPowerLogic PM5561
Version 10.7.3 of the PowerLogic PM5561 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-andcontrol#software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&parent-subcategory-id=4125&filter=business-2-building-automation-and-control#software-and-firmware - BehobenPowerLogic PM5561
Version 10.7.3 of the PowerLogic PM5561 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-andcontrol#software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&parent-subcategory-id=4125&filter=business-2-building-automation-and-control#software-and-firmware - BehobenPowerLogic PM5562
Version 4.3.5 of the PowerLogic PM5562 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000/12146169702-basic-multifunction-metering/?selectednode-id=12146169702&N=brand=se%26countrycode=UK%26language-code=en%26node-id=12146169702 - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&selected-node-id=12146169702&N=brand%253Dse%2526country-code%253DUK%2526language-code%253Den%2526node-id%253D12146169702#software-and-firmware - BehobenPowerLogic PM5562
Version 4.3.5 of the PowerLogic PM5562 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000/12146169702-basic-multifunction-metering/?selectednode-id=12146169702&N=brand=se%26countrycode=UK%26language-code=en%26node-id=12146169702 - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&selected-node-id=12146169702&N=brand%253Dse%2526country-code%253DUK%2526language-code%253Den%2526node-id%253D12146169702#software-and-firmware - BehobenPowerLogic PM5563
Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-and-control - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&parent-subcategory-id=4125&filter=business-2-building-automation-and-control#software-and-firmware - BehobenPowerLogic PM5563
Version 2.8.3 of the PowerLogic PM5560, 5563, 5580 firmware includes fixes for these vulnerabilities. The version update files are available for download here: https://www.se.com/ww/en/product-range/61281-powerlogicpm5000-power-meters/?parent-subcategoryid=4125&filter=business-2-building-automation-and-control - software-and-firmware If customers choose not to apply the remediation provided above, they should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level or disable the HTTP web service to reduce the risk of exposure.
https://www.se.com/ww/en/product-country-selector/?pageType=product-range&sourceId=61281&parent-subcategory-id=4125&filter=business-2-building-automation-and-control#software-and-firmware - BehobenPowerLogic PM8ECC
PowerLogic PM8ECC has reached end of service and is no longer supported. Customers should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level once commissioning is complete to reduce the risk of exposure. Additionally, Customers should ensure the General security Recommendations listed below are in place.
- BehobenPowerLogic PM8ECC
PowerLogic PM8ECC has reached end of service and is no longer supported. Customers should immediately apply the following mitigation to reduce the risk of exploit: Customers should consider blocking HTTP access to the device at the firewall level once commissioning is complete to reduce the risk of exposure. Additionally, Customers should ensure the General security Recommendations listed below are in place.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan