CVE-2022-46680

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-05-22 · updated 2026-06-17
Weakness: CWE-319

Description

A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denial of service, or modification of data if an attacker is able to intercept network traffic.

Affected products

Schneider-Electric Powerlogic Ion7400 Firmware: before 4.0.0 — fixed in 4.0.0
Schneider-Electric Powerlogic Ion8650 Firmware: all versions
Schneider-Electric Powerlogic Ion8800 Firmware: all versions
Schneider-Electric Powerlogic Ion9000 Firmware: before 4.0.0 — fixed in 4.0.0
Schneider-Electric Powerlogic Pm8000 Firmware: before 4.0.0 — fixed in 4.0.0

How to fix

Upgrade to a fixed version: Schneider-Electric Powerlogic Ion7400 Firmware 4.0.0; Schneider-Electric Powerlogic Ion9000 Firmware 4.0.0; Schneider-Electric Powerlogic Pm8000 Firmware 4.0.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-46680 or the next vulnerability affects your stack