A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product.

Published 8 y ago 2018-08-29 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.4

v3.1 · CNA

CISA KEV

not known exploited

EPSS

2.3%

percentile 83%

Public exploits

none known

A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 5 mo ago 2026-05-29

Exploit prediction (EPSS)

2.31% probability of exploitation in the next 30 days, higher than 83% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`
CNA	3.1	5.4	`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N`
NVD	3.0	6.1	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N`
NVD	2.0	4.3	`AV:N/AC:M/Au:N/C:N/I:P/A:N`

Affected products

Schneider Electric SE PowerLogic - PM5560 prior to FW version 2.5.4

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

schneider-electric.com /en/download/document/SEVD-2018-228-01/ · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/105170 · vdb-entry, x_refsource_BID, x_transferred
ics-cert.us-cert.gov /advisories/ICSA-18-240-03 · x_refsource_MISC, x_transferred

Sources

CVE List: CVE-2018-7795
NVD: CVE-2018-7795

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary