CVE-2022-22722 — Hard-coded Credentials in Electric Easergy P5

CWE-798 — Hard-coded Credentials3 documents3 sources
Severity
7.5HIGHNVD
EPSS
0.2%
top 63.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Schneider Electric Easergy P5Schneider-electric Easergy P5 Firmware
Timeline
PublishedFeb 4
Latest updateFeb 11

Description

A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and manipulate traffic associated with product configuration. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101)

CVSS vector

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5schneider_electric/easergy_p5unspecified — 01.401.101

🔴Vulnerability Details

2
GHSA
GHSA-fvg3-mg3w-725q: A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure↗2022-02-11
▶
CVEList
CVE-2022-22722: A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure↗2022-02-04
▶
CVE-2022-22722 — Hard-coded Credentials | cvebase