Summary
Schneider Electric is aware of a vulnerability in its Conext™ Gateway/ InsightHome and InsightFacility products.
The InsightHome and InsightFacility products are smart edge devices that connect customers’ Schneider Electric solar and storage systems to the Insight app. InsightHome targets the residential solar and storage market globally. InsightFacility is for large residential and commercial solar and storage systems. Conext™ Gateway was discontinued from 2019 and rebranded as InsightFacility. However, Schneider is still supporting Gateway with firmware fixes.
Failure to apply the remediations provided below may risk remote code execution, which could result in an authenticated user being able to insert a backdoor into the application or could allow the extraction of private certificates.
Vulnerabilities 1
-
High 7.2
A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same pr…
Revision history
-
#1
Original Release
References
-
Conext™ Gateway/ InsightHome and InsightFacility - SEVD-2023-101-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2023-101-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2023-101-02.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390/