PT-2017-8779 · Schneider Electric · Ion75Xx Series Power Meters+6

T4Rkd3Vilz · Published 2017-02-13 · Updated 2018-05-20 · CVE-2016-5809

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Schneider Electric IONXXXX series power meters versions (affected versions not specified) Schneider Electric ION73XX series power meters versions (affected versions not specified) Schneider Electric ION75XX series power meters versions (affected versions not specified) Schneider Electric ION76XX series power meters versions (affected versions not specified) Schneider Electric ION8650 series power meters versions (affected versions not specified) Schneider Electric ION8800 series power meters versions (affected versions not specified) Schneider Electric PM5XXX series power meters versions (affected versions not specified)

Description The issue is related to the lack of a CSRF Token to authenticate users during sessions. This allows unauthorized configuration changes to be made and saved.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2016-5809

Affected Products

Ion73Xx Series Power Meters

Ion75Xx Series Power Meters

Ion76Xx Series Power Meters

Ion8650 Series Power Meters

Ion8800 Series Power Meters

Ionxxxx Series Power Meters

Pm5Xxx Series Power Meters

References · 4

• 🔥 https://exploit-db.com/exploits/44640 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-5809 · Security Note
• https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03 · Note
• http://securityfocus.com/bid/92916 · Note