Multiple security vulnerabilities have been identified affecting Easergy voltage protection relays developed by Schneider Electric. Voltage protection relays are devices designed to protect motors and systems against over or under-voltage, phase absence, and phase sequence error.
The identified security vulnerabilities are as follows;
- The vulnerability tracked as CVE-2022-22722 exists due to Hard-Coded credentials in the application code. A remote threat actor can use these credentials to view and process device traffic and access the vulnerable system.
- The Buffer-Overflow vulnerability tracked as CVE-2022-22723, can allow threat actors to disable programs or execute arbitrary code on the vulnerable system by sending specially configured packets to the vulnerable device.
Successfully exploiting security vulnerabilities can lead to device credential exposure, device shutdown, or reboot. As a result, the threat actor who takes complete control of the device can endanger the electrical grid’s security.
What do the public records say about these flaws?
Both flaws were published in the National Vulnerability Database on 4 February 2022. The record for CVE-2022-22722 lists the weakness as CWE-798, use of hard-coded credentials. It says an attacker who obtains the SSH cryptographic key of the device and takes active control of the local operational network could observe and change traffic linked to product configuration. NVD gives it a CVSS 3.1 base score of 7.5 (high). The record names Easergy P5 firmware versions before V01.401.101 as affected.
The record for CVE-2022-22723 lists CWE-120, a buffer copy without checking the size of the input. Specially crafted packets sent to the device over the network can cause program crashes and arbitrary code execution. According to the record, protection functions and the tripping function via GOOSE can be affected. NVD gives it a CVSS 3.1 base score of 8.8 (high), and it also names Easergy P5 firmware before V01.401.101.
Both entries point to the vendor’s own security notice, SEVD-2022-011-03 from Schneider Electric. That is the place to check exact product versions and fixes. Note that both attack paths in NVD start from the adjacent network, not from the internet. This is why the advice to keep these devices off the internet and away from untrusted networks matters so much.
All Previous Version of Schneider Electric Easergy P3 V30 and P5 V01 Have Been Fixed
The vulnerabilities affecting all previous versions of Easergy P3 v30.205 and Easergy P5 v01.401.101 have been fixed with the released updates. To avoid being affected by attacks that can be carried out through vulnerabilities, it is recommended to minimize network exposure for all industrial control systems, prevent internet access, and use secure methods such as VPN when remote access is required.