Critical Vulnerabilities in Schneider Electric PowerLogic Devices: Risks & Mitigations

In a striking advisory released by the Cybersecurity and Infrastructure Security Agency (CISA), Schneider Electric's PowerLogic PM5500 series and PM8ECC modules have come under serious scrutiny due to several critical vulnerabilities. If your organization relies on these devices, it’s imperative to understand the nature of these vulnerabilities, the potential risks, and the necessary mitigations.

Executive Summary​

At the heart of the issue is the revelation of vulnerabilities rated 9.5 on the Common Vulnerability Scoring System (CVSS v4), indicating a high level of severity. The vulnerabilities identified include:

• Weak Password Recovery Mechanism for Forgotten Passwords (CWE-640)
• Improper Authentication (CWE-287)

Both of these weaknesses could allow an attacker to remotely exploit the devices, posing risks that range from unauthorized access to complete control over the affected systems.

Risk Evaluation​

The exploitation of these vulnerabilities presents a cataclysmic risk. For instance, an attacker could escalate their privileges on these devices, gaining control over critical infrastructure components. Such access could facilitate not only theft of sensitive data but also potential service disruptions.

Technical Details​

Affected Products​

The vulnerabilities affect the following versions of the PowerLogic PM55xx meter and PM8ECC Ethernet communication module:

• PM5560: Versions prior to v2.7.8
• PM5561: Versions prior to v10.7.3
• PM5562: Versions v2.5.4 and prior
• PM5563: Versions prior to v2.7.8
• PM8ECC: All versions

Vulnerability Overview​

Weak Password Recovery Mechanism (CWE-640)​

This aspect has been documented under CVE-2021-22763. The weak mechanism allows attackers to bypass legitimate user authentication, leading to unauthorized access and potential service denial for the rightful users. The severity score stands at 8.1 (CVSS v3.1) and 9.5 (CVSS v4).

Improper Authentication (CWE-287)​

Documented under CVE-2021-22764, this vulnerability indicates that the device employs flawed authentication processes, which could allow attackers to access sensitive information or even execute remote code. The severity score for this vulnerability is 5.3 (CVSS v3.1) and 6.9 (CVSS v4).

Background​

These vulnerabilities impact critical infrastructure, notably within the Energy sector and are observed in various global locations. Understanding that Schneider Electric is headquartered in France gives context to the multinational implications of these vulnerabilities.

Mitigations​

Schneider Electric has proactively provided remediation strategies to counter these vulnerabilities:

• Network Protection: Disable HTTP access or block it via firewall settings to minimize exposure risks.
• Firmware Updates:
• Upgrade PowerLogic PM5560, PM5563, PM5580 to version 2.8.3.
• Upgrade PowerLogic PM5561 to version 10.7.3.
• Upgrade PowerLogic PM5562 to version 4.3.5.
• End of Service for PM8ECC: Recognize that the PM8ECC has reached its end of service and is no longer supported, making it important to replace or decommission it.

Cybersecurity Best Practices​

Adhering to industry best practices is critical for safeguarding systems:

• Network Configuration: Keep control networks isolated behind firewalls.
• Physical Security: Install physical safeguards to limit access to essential industrial systems.
• Regular Updates and Isolation: Regularly update software and only connect devices designed for specific networks.
• Limit Network Exposure: Ensure devices are not publicly accessible via the Internet and utilize secure remote access methods such as VPNs.

For comprehensive security practices, users are encouraged to refer to Schneider Electric's recommended cybersecurity best practices documentation and accompanying advisories issued by CISA.

Conclusion​

In a landscape that increasingly relies on interconnected devices, the vulnerabilities associated with Schneider Electric's PowerLogic PM5500 and PM8ECC modules underscore the importance of vigilant security practices. With the potential implications ranging from operational disruption to data theft, it’s crucial that organizations take immediate steps to address these vulnerabilities through updates and enhanced security measures.
For further assistance and resources, CISA’s dedicated webpage on industrial control systems provides valuable guidance on best practices and response strategies for organizations navigating these threats.

---

Source: CISA Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC | CISA