What’s Vulnerable › Vulnerabilities

CVE-2016-5809

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-02-13 · updated 2026-06-17
• Weakness: CWE-352

Description

An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved.

Affected products

• Schneider-Electric Ion5000: all versions
• Schneider-Electric Ion7300: all versions
• Schneider-Electric Ion7500: all versions
• Schneider-Electric Ion7600: all versions
• Schneider Electric ION8650: all versions
• Schneider Electric ION8800: all versions

References

• http://www.securityfocus.com/bid/92916
• https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03
• https://www.exploit-db.com/exploits/44640/
• http://www.securityfocus.com/bid/92916
• https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03
• https://www.exploit-db.com/exploits/44640/

Get alerted when CVE-2016-5809 or the next vulnerability affects your stack