Summary
Schneider Electric is aware of multiple vulnerabilities in its Wiser Smart products.
The Wiser Smart [EER21000 and EER21001] products is a home automation system which reports your energy consumption and controls the most energy consuming devices.
Failure to apply the mitigations provided below may risk root level access attack, which could result in execution of arbitrary code.
Vulnerabilities 6
-
Critical 9.4
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root …
-
High 8.6
A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could allow unauthorized…
-
High 8.3
A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to take over the admin account whe…
-
High 8.2
A CWE-669: Incorrect Resource Transfer Between Spheres vulnerability exists that could allow unauthorized access when a…
-
High 8.2
A CWE-311: Missing Encryption of Sensitive Data vulnerability exists that could allow authentication credentials to be …
-
Medium 6.5
A CWE-20: Improper Input Validation vulnerability exists that could allow the product to be maliciously manipulated whe…
Revision history
-
#1.0.0
Original Release
References
-
Wiser Smart - SEVD-2022-130-03 PDF Version
https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-130-03_WiserSmart_Security_Notification.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/