An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes.
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ion5000 | Schneider-electric | - (including) | - (including) |
| Ion7300 | Schneider-electric | - (including) | - (including) |
| Ion7500 | Schneider-electric | - (including) | - (including) |
| Ion7600 | Schneider-electric | - (including) | - (including) |
| Ion8650 | Schneider-electric | - (including) | - (including) |
| Ion8800 | Schneider-electric | - (including) | - (including) |
Access control involves the use of several protection mechanisms such as:
When any mechanism is not applied or otherwise fails, attackers can compromise the security of the product by gaining privileges, reading sensitive information, executing commands, evading detection, etc. There are two distinct behaviors that can introduce access control weaknesses: