PT-2022-3624 · Schneider Electric · Easergy P5

Published 2022-07-12 · Updated 2022-07-27 · CVE-2022-34758

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:L/AC:L/Au:S/C:N/I:C/A:P

Name of the Vulnerable Software and Affected Versions Easergy P5 versions V01.401.102 and prior

Description A vulnerability exists due to improper input validation, which could cause the device watchdog function to be disabled if an attacker has access to privileged user credentials. This issue can be exploited remotely.

Recommendations For Easergy P5 versions V01.401.102 and prior, update to a version later than V01.401.102 to resolve the issue. As a temporary workaround, consider restricting access to privileged user credentials to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-04409

CVE-2022-34758

Affected Products

Easergy P5

References · 7

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-34758 · Security Note
• https://osv.dev/vulnerability/CVE-2022-34758 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-04409 · Security Note
• https://t.me/cibsecurity/46215 · Telegram Post
• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-193-04&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-193-04_Easergy_P5_Security_Notification.pdf · Note
• https://t.me/cvenotify/33024 · Telegram Post