What is the CVSS score of CVE-2021-22703?

CVE-2021-22703 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Powerlogic Ion7400 Firmware CVE-2021-22703

HIGH

Cleartext Transmission of Sensitive Information (CWE-319)

2021-02-19 cybersecurity@se.com

Information Disclosure Powerlogic Ion7400 Firmware Powerlogic Ion7650 Firmware Powerlogic Ion8600 Firmware Powerlogic Ion8650 Firmware Powerlogic Ion8800 Firmware Powerlogic Ion9000 Firmware Powerlogic Pm8000 Firmware Powerlogic Ion8300 Firmware Powerlogic Ion8400 Firmware Powerlogic Ion8500 Firmware

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Feb 19, 2021 - 16:15 cve.org

HIGH 7.5

DescriptionCVE.org

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device.

AnalysisAI

A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-319. A CWE-319: Cleartext transmission of sensitive information vulnerability exists in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600, ION8650, ION8800, ION9000 and PM800 (see notification for affected versions), that could cause disclosure of user credentials when a malicious actor intercepts HTTP network traffic between a user and the device. Affected products include: Schneider-Electric Powerlogic Ion7400 Firmware, Schneider-Electric Powerlogic Ion7650 Firmware, Schneider-Electric Powerlogic Ion8600 Firmware, Schneider-Electric Powerlogic Ion8650 Firmware, Schneider-Electric Powerlogic Ion8800 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.