PT-2022-1851 · Schneider Electric · Easergy P5

Published 2022-01-11 · Updated 2022-03-02 · CVE-2022-22722

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easergy P5 versions prior to V01.401.101

Description The issue is related to errors in managing SSH keys, which could allow an attacker to gain unauthorized access to protected information. An attacker who obtains the SSH cryptographic key for the device and gains control of the local operational network could potentially observe and manipulate traffic associated with product configuration.

Recommendations For versions prior to V01.401.101, update to version V01.401.101 or later to resolve the issue. As a temporary workaround, consider restricting access to the SSH key management functionality to minimize the risk of exploitation.

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2022-01320

CVE-2022-22722

Affected Products

Easergy P5

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-22722 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-03 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01320 · Security Note
• https://osv.dev/vulnerability/CVE-2022-22722 · Vendor Advisory
• https://t.me/true_secator/2689 · Telegram Post
• https://t.me/s_e_reborn/1903 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2022011209 · Note