Vulnerability Description
An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Schneider-Electric | Ion5000 | - |
| Schneider-Electric | Ion7300 | - |
| Schneider-Electric | Ion7500 | - |
| Schneider-Electric | Ion7600 | - |
| Schneider-Electric | Ion8650 | - |
| Schneider-Electric | Ion8800 | - |
Related Weaknesses (CWE)
References
- http://www.securityfocus.com/bid/92916Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03Third Party AdvisoryUS Government Resource
- https://www.exploit-db.com/exploits/44640/
- http://www.securityfocus.com/bid/92916Third Party AdvisoryVDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03Third Party AdvisoryUS Government Resource
- https://www.exploit-db.com/exploits/44640/
FAQ
What is CVE-2016-5809?
CVE-2016-5809 is a vulnerability with a CVSS score of 8.8 (HIGH). An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token gene...
How severe is CVE-2016-5809?
CVE-2016-5809 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-5809?
Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Ion5000, Schneider-Electric Ion7300, Schneider-Electric Ion7500, Schneider-Electric Ion7600, Schneider-Electric Ion8650.