CVE-2022-46680 Information disclosure in PowerLogic PM8000
Attackers intercepting network traffic can disclose sensitive information, modify data, or cause denial of service in Schneider Electric PowerLogic devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-46680?
CVE-2022-46680 is a high-severity vulnerability in Schneider Electric PowerLogic PM8000, published on 22 May 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denial of service, or modification of data if an attacker is able to intercept network traffic.
Weakness: CWE-319
Which versions are affected by CVE-2022-46680?
It affects 5 products.
Products include Schneider-Electric Powerlogic Ion7400 Firmware, Schneider-Electric Powerlogic Ion8650 Firmware, Schneider-Electric Powerlogic Ion8800 Firmware, Schneider-Electric Powerlogic Ion9000 Firmware, Schneider-Electric Powerlogic Pm8000 Firmware.
How do I fix CVE-2022-46680?
No fix has been published for CVE-2022-46680 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-46680 being exploited?
There is no known exploitation of CVE-2022-46680 in the wild and no public exploit code.
Other vulnerabilities in Schneider Electric PowerLogic PM8000
- CVE-2021-22714 Memory corruption in PowerLogic ION7400, PM8000 and ION9000 (All versions prior to V3.0.0)
- CVE-2021-22701 Cross-site request forgery in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions)
- CVE-2021-22703 Information disclosure in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions)
Sources
Also known as GHSA-fhxw-qvv7-c595.