CVE-2019-6814

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 36.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-05-22 · updated 2026-06-17
Weakness: CWE-287

Description

A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI.

Affected products

Schneider-Electric Net5500 Firmware: before 2.1.9.7 — fixed in 2.1.9.7
Schneider-Electric Net5501-I Firmware: before 2.1.9.7 — fixed in 2.1.9.7
Schneider-Electric Net5501-Xt Firmware: before 2.1.9.7 — fixed in 2.1.9.7
Schneider-Electric Net5501 Firmware: before 2.1.9.7 — fixed in 2.1.9.7
Schneider-Electric Net5504 Firmware: before 2.1.9.7 — fixed in 2.1.9.7
Schneider-Electric Net5508 Firmware: before 2.1.9.7 — fixed in 2.1.9.7
Schneider-Electric Net5516 Firmware: before 2.1.9.7 — fixed in 2.1.9.7

How to fix

Upgrade to a fixed version: Schneider-Electric Net5500 Firmware 2.1.9.7; Schneider-Electric Net5501-I Firmware 2.1.9.7; Schneider-Electric Net5501-Xt Firmware 2.1.9.7; Schneider-Electric Net5501 Firmware 2.1.9.7; Schneider-Electric Net5504 Firmware 2.1.9.7; Schneider-Electric Net5508 Firmware 2.1.9.7; Schneider-Electric Net5516 Firmware 2.1.9.7. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-6814 or the next vulnerability affects your stack