What’s Vulnerable › Vulnerabilities

CVE-2021-22764

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-06-11 · updated 2026-06-17
• Weakness: CWE-287

Description

A CWE-287: Improper Authentication vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could cause loss of connectivity to the device via Modbus TCP protocol when an attacker sends a specially crafted HTTP request.

Affected products

• Schneider Electric SE PowerLogic - PM5560 prior to FW version 2.5.4: before 2.7.8 — fixed in 2.7.8
• Schneider-Electric Powerlogic Pm5561 Firmware: before 10.7.3 — fixed in 10.7.3
• Schneider-Electric Powerlogic Pm5562 Firmware: through 2.5.4
• Schneider-Electric Powerlogic Pm5563 Firmware: before 2.7.8 — fixed in 2.7.8

How to fix

Upgrade to a fixed version: Schneider Electric SE PowerLogic - PM5560 prior to FW version 2.5.4 2.7.8; Schneider-Electric Powerlogic Pm5561 Firmware 10.7.3; Schneider-Electric Powerlogic Pm5563 Firmware 2.7.8. Check the vendor advisory for mitigations.

References

• https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2021-159-02.pdf
• http://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-02%2Chttp://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2021-159-03

Get alerted when CVE-2021-22764 or the next vulnerability affects your stack