CVE-2021-22763

CRITICAL

PowerLogic PM55xx, PM8ECC, EGX100, EGX300 - Weak Password Recovery Mechanism

Title source: llm

Description

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.

References (2)

Core 2

Core References

Various Sources

http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03

Various Sources x_refsource_misc

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf

Scores

CVSS v3 9.8

EPSS 0.0184

EPSS Percentile 76.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-640

Status published

Products (6)

None/PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notifica

schneider-electric/powerlogic_pm5560_firmware < 2.7.8

schneider-electric/powerlogic_pm5561_firmware < 10.7.3

schneider-electric/powerlogic_pm5562_firmware < 2.5.4

schneider-electric/powerlogic_pm5563_firmware < 2.7.8

schneider-electric/powerlogic_pm8ecc_firmware

Published Jun 11, 2021

Tracked Since Feb 18, 2026