What’s Vulnerable › Vulnerabilities

CVE-2021-22763

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-11 · updated 2026-06-17
• Weakness: CWE-640

Description

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.

Affected products

• Schneider Electric SE PowerLogic - PM5560 prior to FW version 2.5.4: before 2.7.8 — fixed in 2.7.8
• Schneider-Electric Powerlogic Pm5561 Firmware: before 10.7.3 — fixed in 10.7.3
• Schneider-Electric Powerlogic Pm5562 Firmware: through 2.5.4
• Schneider-Electric Powerlogic Pm5563 Firmware: before 2.7.8 — fixed in 2.7.8
• Schneider Electric PowerLogic 2.651 and older: all versions

How to fix

Upgrade to a fixed version: Schneider Electric SE PowerLogic - PM5560 prior to FW version 2.5.4 2.7.8; Schneider-Electric Powerlogic Pm5561 Firmware 10.7.3; Schneider-Electric Powerlogic Pm5563 Firmware 2.7.8. Check the vendor advisory for mitigations.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03

Get alerted when CVE-2021-22763 or the next vulnerability affects your stack