9.8crit
CVE-2016-5815
An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, I…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.5%
percentile 84%
Public exploits
0
none known
Summary
An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes.
Exploit prediction (EPSS)
2.45% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a Schneider Electric IONXXXX Series Power Meter Vulnerabilities
Classification
- Weakness
- CWE-284 Improper Access Control
References
- securityfocus.com /bid/94091 · vdb-entry, x_refsource_BID, x_transferred
- ics-cert.us-cert.gov /advisories/ICSA-16-308-03 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2016-5815
- NVD: CVE-2016-5815
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.