Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-7795: PowerLogic PM5560 firmware allows web page code injection

CVE-2018-7795 · published 8 years ago

Summary

The PowerLogic PM5560 device with firmware older than version 2.5.4 can be tricked into running malicious JavaScript in its built‑in web browser. This could let an attacker display false information or steal data entered by users. Update the device to the latest firmware to stop the problem.

What to do

Update schneider-electric powerlogic_pm5560_firmware to version 2.5.4 or later.

Affected software

Vendor	Product	Affected versions
schneider-electric	powerlogic_pm5560_firmware	< 2.5.4 `cpe:2.3:o:schneider-electric:powerlogic_pm5560_firmware::::::::`

Original advisory text

A Cross Protocol Injection vulnerability exists in Schneider Electric's PowerLogic (PM5560 prior to FW version 2.5.4) product. The vulnerability makes the product susceptible to cross site scripting attack on its web browser. User inputs can be manipulated to cause execution of java script code.

References

http://www.securityfocus.com/bid/105170 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-18-240-03 Mitigation Third Party Advisory US Government Resource
https://www.schneider-electric.com/en/download/document/SEVD-2018-228-01/ Mitigation Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

5.4 Medium

Exploitation

2% chance of attack within 30 days

Type

CWE-79Cross-site Scripting (XSS)

Timeline

Published29 Aug 2018

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-7795 · NVD

Track software like this

Free during beta