A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in full control over the device.

A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure.

Schneider Electric is aware of multiple vulnerabilities in its PowerLogic ION8650 and PowerLogic ION8800 products. The PowerLogic products are revenue and power quality meters for utility electrical network monitoring. Failure to apply the mitigations provided below may risk an attacker with administrative privileges installing compromised firmware on the device, resulting in modified device behavior, or modifying webpages on the device in a malicious way, which could result in other viewers of that webpage being exposed to a cross-site scripting attack.

December 2023 Update: We have added supplementary information in the vulnerability details and mitigations for CVE-2023-5984.