CVE-2021-22703 Information disclosure in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions)

Medium 5.9 Published 19 Feb 2021 Updated 29 May 2026

Attackers can intercept HTTP traffic to disclose user credentials on PowerLogic ION devices due to cleartext transmission.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-22703?

CVE-2021-22703 is a medium-severity vulnerability in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), published on 19 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device.

Weakness: CWE-319

Which versions are affected by CVE-2021-22703?

It affects 10 products.

Products include Schneider-Electric Powerlogic Ion7400 Firmware, Schneider-Electric Powerlogic Ion7650 Firmware, Schneider-Electric Powerlogic Ion8300 Firmware, Schneider-Electric Powerlogic Ion8400 Firmware, Schneider-Electric Powerlogic Ion8500 Firmware, Schneider-Electric Powerlogic Ion8600 Firmware and 4 more.

How do I fix CVE-2021-22703?

No fix has been published for CVE-2021-22703 yet. Limit exposure of the affected software until one is available.

Is CVE-2021-22703 being exploited?

There is no known exploitation of CVE-2021-22703 in the wild and no public exploit code.

Sources

Also known as GHSA-q772-ppcv-m7pf.