PT-2017-8779 · Schneider Electric · Ion75Xx Series Power Meters+6

T4Rkd3Vilz · Publicado 2017-02-13 · Atualizado 2018-05-20 · CVE-2016-5809

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Schneider Electric IONXXXX series power meters versions (affected versions not specified) Schneider Electric ION73XX series power meters versions (affected versions not specified) Schneider Electric ION75XX series power meters versions (affected versions not specified) Schneider Electric ION76XX series power meters versions (affected versions not specified) Schneider Electric ION8650 series power meters versions (affected versions not specified) Schneider Electric ION8800 series power meters versions (affected versions not specified) Schneider Electric PM5XXX series power meters versions (affected versions not specified)

Description The issue is related to the lack of a CSRF Token to authenticate users during sessions. This allows unauthorized configuration changes to be made and saved.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2016-5809

Produtos afetados

Ion73Xx Series Power Meters

Ion75Xx Series Power Meters

Ion76Xx Series Power Meters

Ion8650 Series Power Meters

Ion8800 Series Power Meters

Ionxxxx Series Power Meters

Pm5Xxx Series Power Meters

Referências · 4

• 🔥 https://exploit-db.com/exploits/44640 · Exploit
• https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-5809 · Nota de Segurança
• http://securityfocus.com/bid/92916 · Nota