Lucene search

[email protected]CVE-2021-22701

HistoryFeb 19, 2021 - 4:15 p.m.

CVE-2021-22701

2021-02-1916:15:12

CWE-352

[email protected]

web.nvd.nist.gov

cve-2021-22701

cross-site request forgery

powerlogic

ion7400

ion7650

ion83xx

ion84xx

ion85xx

ion8600

ion8650

ion8800

ion9000

pm800

http web interface

security vulnerability

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

A CWE-352: Cross-Site Request Forgery vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause a user to perform an unintended action on the target device when using the HTTP web interface.

Affected configurations

NVD

Node

schneider-electricpowerlogic_ion7400_firmwareRange<3.0.0

AND

schneider-electricpowerlogic_ion7400Match-

schneider-electricpowerlogic_ion7410Match-

Node

schneider-electricpowerlogic_ion7650_firmware

AND

schneider-electricpowerlogic_ion7650Match-

Node

schneider-electricpowerlogic_ion8600_firmware

AND

schneider-electricpowerlogic_ion8600Match-

Node

schneider-electricpowerlogic_ion8650_firmwareRange≤4.31.2

AND

schneider-electricpowerlogic_ion8650Match-

Node

schneider-electricpowerlogic_ion8800_firmware

AND

schneider-electricpowerlogic_ion8800Match-

Node

schneider-electricpowerlogic_ion9000_firmwareRange<3.0.0

AND

schneider-electricpowerlogic_ion9000Match-

Node

schneider-electricpowerlogic_pm8000_firmwareRange<3.0.0

AND

schneider-electricpowerlogic_pm8000Match-

Node

schneider-electricpowerlogic_ion8300_firmware

AND

schneider-electricpowerlogic_ion8300Match-

Node

schneider-electricpowerlogic_ion8400_firmware

AND

schneider-electricpowerlogic_ion8400Match-

Node

schneider-electricpowerlogic_ion8500_firmware

AND

schneider-electricpowerlogic_ion8500Match-

CPENameOperatorVersion
schneider-electric:powerlogic_ion7400_firmwareschneider-electric powerlogic ion7400 firmwarelt3.0.0

CPE	Name	Operator	Version
schneider-electric:powerlogic_ion7400_firmware	schneider-electric powerlogic ion7400 firmware	lt	3.0.0

CNA Affected

[
  {
    "product": "PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions)",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "EcoStruxure™ Operator Terminal Expert 3.1 Service Pack 1A and prior running on Harmony HMIs HMIST6 Series, HMIG3U in HMIGTU Series, HMISTO Series and Pro-face BLUE 3.1 Service Pack 1A and prior running on Pro-face HMIs: ST6000 Series, SP-5B41 in SP5000 Series, GP4100 Series"
      }
    ]
  }
]

References

www.se.com/ww/en/download/document/SEVD-2021-040-01/

Social References

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

4.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N

4.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

10.5%

JSON

Related for CVE-2021-22701

prion1 nessus1 nvd1 cvelist1