CVE-2016-5815 Missing authorization in Schneider Electric IONXXXX Series Power Meter Vulnerabilities
Unauthorized users can access the management portal and modify configurations because authentication is disabled by default on Schneider Electric power meters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-5815?
CVE-2016-5815 is a critical missing authorization vulnerability in Schneider Electric IONXXXX Series Power Meter Vulnerabilities, published on 13 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes.
Weakness: CWE-284
Which versions are affected by CVE-2016-5815?
It affects 6 products.
Products include Schneider-Electric Ion5000, Schneider-Electric Ion7300, Schneider-Electric Ion7500, Schneider-Electric Ion7600, Schneider-Electric Ion8650, Schneider-Electric Ion8800.
How do I fix CVE-2016-5815?
No fix has been published for CVE-2016-5815 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2016-5815 being exploited?
There is no known exploitation of CVE-2016-5815 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric IONXXXX Series Power Meter Vulnerabilities
Sources
Also known as GHSA-mfpm-xw3v-wfrj.