CVE-2018-7795: A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the…

PriorityP427medium5.4CVSS 3.1

AVNACLPRNUIRSUCLILAN

EPSS

2.30%

81.3th percentile

A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
schneider-electric	powerlogic_pm5560_firmware	< 2.5.4	2.5.4
schneider_electric_se	powerlogic_pm5560_prior_to_fw_version_2.5.4	—	—

CVSS provenance

nvdv3.15.4MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.