Skip to content
OpenAdvisories
Critical SEVD-2021-159-03 6 CVEs

PowerLogic EGX100 and PowerLogicEGX300

Published Jun 8, 2021 · Updated Jun 8, 2021

Vendor: Schneider Electric Product: EGX100 Product: EGX300

Summary

Schneider Electric is aware of multiple vulnerabilities in its PowerLogic EGX100 and EGX300
products.
The PowerLogic EGX100 and EGX300 are communication gateway devices.
Failure to apply the mitigations provided below may risk denial of service or remote code
execution, which could result in loss of device functionality.

Vulnerabilities 6

  • Critical 9.8
    CVE-2021-22763

    A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogi…

  • Critical 9.8
    CVE-2021-22765

    A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…

  • Critical 9.8
    CVE-2021-22767

    A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…

  • Critical 9.8
    CVE-2021-22768

    A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…

  • High 7.5
    CVE-2021-22766

    A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic…

  • Medium 5.3
    CVE-2021-22764

    A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and …

Revision history

  1. #1.0.0

    Original Release

References