Vulnerability CVE-2016-5809

Vulnerability CVE-2016-5809

Published: 2017-02-13 Modified: 2017-02-14

Description:

An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved.

See advisories in our WLB2 database:

	Topic	Author	Date
Low	Powerlogic/Schneider Electric IONXXXX Series Cross Site Request Forgery	t4rkd3vilz	18.05.2018

Type:

CWE-352

(Cross-Site Request Forgery (CSRF))

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
6.8/10	6.4/10	8.6/10

Exploit range	Attack complexity	Authentication
Remote	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Schneider-electric -> Ion7600
Schneider-electric -> Ion8650
Schneider-electric -> Ion5000
Schneider-electric -> Ion8800
Schneider-electric -> Ion7300
Schneider-electric -> Ion7500

References:

http://www.securityfocus.com/bid/92916

https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03

https://www.exploit-db.com/exploits/44640/

Copyright 2024, cxsecurity.com