CVE-2022-34758

A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged user credentials. Affected Products: Easergy P5 V01.401.102 and prior...

The vulnerability of the GOOSE (Generic Object-Oriented Substation Event) protocol implementation in Schneider Electric Easergy P5 micro-programmed devices for relay protection and control allows a perpetrator to execute arbitrary code or cause malfunctions during maintenance.

The vulnerability of the GOOSE Generic Object-Oriented Substation Event protocol implementation in Schneider Electric Easergy P5 relay protection and control devices relates to the copying of buffers without checking the size of input data. Exploiting this vulnerability can allow attackers to...

Schneider Electric Easergy P5 and P3

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Low attack complexity Vendor: Schneider Electric Equipment: Easergy P5 and P3 --------- Begin Update A Part 1 of 4 --------- Vulnerabilities: Use of Hard-Coded Credentials, Classic Buffer Overflow, and Improper Input Validation --------- End Update A...

CVE-2022-22723

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be...

CVE-2022-22722

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and...

CVE-2022-22722

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and...

CVE-2022-22722

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and...

CVE-2022-22723

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be...

Hardcoded credentials

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and...

Buffer overflow

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be...

CVE-2022-22723

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be...

CVE-2022-22723

CVE-2022-22723 is a buffer-copy-via-input vulnerability in Schneider Electric’s Easergy P5 (all firmware versions prior to v01.401.101) that can cause crashes and arbitrary code execution when receiving specially crafted network packets. Connected docs confirm a related, separate CVE-2022-22725 a...

CVE-2022-22722

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and...

CVE-2022-22722

The CVE-2022-22722 vulnerability affects Schneider Electric Easergy P5 (and related P3 issues) with a root cause of hard-coded credentials that could enable an attacker who gains SSH access to observe and manipulate device-config traffic, potentially leading to information disclosure and control ...

Schneider Electric Easergy P5 Buffer Overflow Vulnerability

The Schneider Electric Easergy P5 is a protective relay for demanding medium voltage applications from Schneider Electric, France. The Schneider Electric Easergy P5 is vulnerable to a buffer overflow vulnerability that exists due to a boundary error when handling untrusted input. An attacker coul...

Schneider Electric Easergy P5 Trust Management Issue Vulnerability

The Schneider Electric Easergy P5 is a protective relay for demanding medium voltage applications from Schneider Electric, France. The Schneider Electric Easergy P5 is vulnerable to a trust management issue, which exists due to the presence of hard-coded credentials in the application code. An...

Schneider Electric Easergy P5 信任管理问题漏洞

The Schneider Electric Easergy P5 is a protective relay for demanding medium voltage applications from Schneider Electric, France. The Schneider Electric Easergy P5 is vulnerable to a trust management issue, which exists due to the presence of hard-coded credentials in the application code. An...

Schneider Electric Easergy P5 缓冲区错误漏洞

The Schneider Electric Easergy P5 is a protective relay for demanding medium voltage applications from Schneider Electric, France. The Schneider Electric Easergy P5 is vulnerable to a buffer overflow vulnerability that exists due to a boundary error when handling untrusted input. An attacker coul...

Security Bulletin: Publicly disclosed vulnerability in GNU Binutils affects IBM Netezza Platform Software

Summary GNU Binutils is used by IBM Netezza Platform Software. IBM Netezza Platform Software has addressed the applicable CVE. Vulnerability Details CVEID: CVE-2021-3549 DESCRIPTION: GNU Binutils is vulnerable to a denial of service, caused by an out-of-bounds flaw in the objdump utility. By...

ISC BIND DoS Vulnerability (CVE-2017-3137) - Windows

ISC BIND is prone to a denial of service DoS vulnerability. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...