PT-2022-3623 · Schneider Electric · Easergy P5

Published 2022-07-12 · Updated 2022-07-27 · CVE-2022-34756

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Easergy P5 versions V01.401.102 and prior

Description A buffer copy without checking the size of input vulnerability exists, which could result in remote code execution or the crash of the HTTPS stack used for the device Web HMI. This issue may allow a remote attacker to execute arbitrary code.

Recommendations For Easergy P5 versions V01.401.102 and prior, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2022-04408

CVE-2022-34756

Affected Products

Easergy P5

References · 7

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-34756 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34756 · Security Note
• https://bdu.fstec.ru/vul/2022-04408 · Security Note
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf · Note
• https://t.me/cvenotify/33026 · Telegram Post
• https://t.me/cibsecurity/46214 · Telegram Post