Summary
Overview
Schneider Electric is aware of a vulnerability in its PowerLogic PM55xx and PowerLogic
PM8ECC products.
The PowerLogic PM55xx products are power metering devices. The PowerLogic PM8ECC
product is an ethernet communication module.
Failure to apply the mitigations or remediations provided below may risk elevation of privileges,
which could result in loss of control of the affected device.
Vulnerabilities 2
-
Critical 9.8
A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogi…
-
Medium 5.3
A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and …
Revision history
-
#2.0.0
Remediation now available for PM5562.
-
#1.0.0
Original Release
References
-
PowerLogic PM5500 and PowerLogic PM8ECC - SEVD-2021-159-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2021-159-02.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/
-
ICS Advisory ICSA-24-331-01 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-01
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B