Schneider Electric Easergy p5 Firmware vulnerabilities

5 CVEs affecting Schneider Electric Easergy p5 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-34758, published 2022-07-13.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-22723, published 2022-02-04. High severity, CVSS 8.8. EPSS: 2.8% chance of exploitation in the next 30 days. A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are…
CVE-2022-22722, published 2022-02-04. High severity, CVSS 7.5. EPSS: 2.4% chance of exploitation in the next 30 days. A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active…
CVE-2022-34756, published 2022-07-13. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution or the crash of HTTPs stack which is used for the device Web HMI. Affected…
CVE-2022-34758, published 2022-07-13. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. A CWE-20: Improper Input Validation vulnerability exists that could cause the device watchdog function to be disabled if the attacker had access to privileged user credentials. Affected Products:…
CVE-2022-34757, published 2022-07-13. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. A CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists where weak cipher suites can be used for the SSH connection between Easergy Pro software and the device, which may…