CVE-2022-22725

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-04 · updated 2026-06-17
Weakness: CWE-120

Description

A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P3 (All versions prior to V30.205)

Affected products

Easergy P3 (All versions prior to V30.205): before 30.205 — fixed in 30.205

How to fix

Upgrade to a fixed version: Easergy P3 (All versions prior to V30.205) 30.205. Check the vendor advisory for mitigations.

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-04
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2022-011-04

Get alerted when CVE-2022-22725 or the next vulnerability affects your stack