CVEvulnerability
CVE-2018-7795
5.4 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2018-08-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 5.4 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
- CVSS 3.0 ([email protected])
- 6.1 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.
Affected configurations
• schneider-electric powerlogic pm5560 firmware (< 2.5.4)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://www.securityfocus.com/bid/105170 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03 Mitigation, Third Party Advisory, US Government Resource
- https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/ Mitigation, Vendor Advisory
- http://www.securityfocus.com/bid/105170 Third Party Advisory, VDB Entry
- https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03 Mitigation, Third Party Advisory, US Government Resource
- https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/ Mitigation, Vendor Advisory