Buffer overflow in Schneider-Electric Easergy P3
CVE-2022-22725
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P3 (All versions prior to V30.205)
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.028 (85.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 86th percentile — 85.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.028 · newest: 0.028 · change: 0.000
Affected products
- Schneider-Electric Easergy P3
- Schneider-Electric Easergy P3 Firmware
- Easergy P3 (All Versions Prior To V30.205) — versions Easergy P3 (All versions prior to V30.205)
Weakness classification (CWE)
References
- download.schneider-electric.com/files (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22725?
- CVE-2022-22725 is a high-severity vulnerability in Schneider-Electric Easergy P3, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.8/10. Published 2022-02-04.
- How severe is CVE-2022-22725?
- High severity. CVSS v3 base score is 8.8 out of 10.