Summary
Schneider Electric is aware of multiple vulnerabilities in its spaceLYnk, Wiser For KNX, and fellerLYnk products.
spaceLYnk is a centralized solution that reduces energy and maintenance costs, increases comfort and flexibility, and simplifies building management.
Wiser for KNX ,formerly known as homeLYnk, products are personalized energy efficiency solutions, offering a complete system based on open protocols: KNX, Modbus, BACnet and IP.
fellerLYnk offers more flexibility in visualization and trend recording as well as functions such as presence simulation or time switches that the end customer can easily manage.
Failure to apply the remediations provided below may risk a Cross-Site Request Forgery (CSRF), Missing Authentication, rate limit, or Stored Cross-Site Scripting (XSS) attack which could result in exfiltrated data and unauthorized access.
March 2022 Update: The CVSS score has been updated for CVE-2022-22811 and CVE-2022-22812
Vulnerabilities 4
-
Unscored —
A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow modifications of the touc…
-
Unscored —
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow an attacker …
-
Unscored —
A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could induce users to perform unintended actions…
-
Unscored —
A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists tha…
Revision history
-
#1.1.0
March 2022 Update: The CVSS score has been updated for CVE-2022-22811 and CVE-2022-22812.
-
#1.0.0
Original release
References
-
spaceLYnk, Wiser For KNX, fellerLYnk - SEVD-2022-039-04 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-039-04
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/