Improper Input Validation in PowerLogic EGX100 and EGX300 by Schneider Electric
CVE-2021-22767

9.8CRITICAL

Key Information:

Vendor
Schneider Electric
Status
Powerlogic Egx100 (versions 3.0.0 And Newer) And Powerlogic Egx300 (all Versions)
Vendor
CVE Published:
11 June 2021

Summary

An improper input validation vulnerability in Schneider Electric's PowerLogic EGX100 and EGX300 may lead to severe consequences, including potential denial of service or remote code execution. Specifically, the flaw arises due to the handling of specially crafted HTTP packets, which can be exploited to manipulate the system's response. Users of affected versions should implement recommended security measures to mitigate risks.

Affected Version(s)

PowerLogic EGX100 ( 3.0.0 and newer) and PowerLogic EGX300 (All ) PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions)

References

http://download.schneider-electric.com/files?p_Doc_Ref=SE...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.