CVE-2021-22764

CWE-287 — Improper Authentication3 documents3 sources
Severity
5.3MEDIUM
EPSS
0.2%
top 51.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Schneider-electric Powerlogic Pm5560 FirmwareSchneider-electric Powerlogic Pm5561 FirmwareSchneider-electric Powerlogic Pm5563 Firmware+1 more
Timeline
PublishedJun 11
Latest updateMay 24

Description

A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

🔴Vulnerability Details

2
GHSA
GHSA-57rv-qg24-x8hj: A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security↗2022-05-24
▶
CVEList
CVE-2021-22764: A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security↗2021-06-11
▶
CVE-2021-22764 (MEDIUM CVSS 5.3) | A CWE-287: Improper Authentication | cvebase.io