Buffer overflow in Schneider-Electric Easergy P3
CVE-2022-22725
A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could lead to a buffer overflow causing program crashes and arbitrary code execution when specially crafted packets are sent to the device over the network. Protection functions and tripping function via GOOSE can be impacted. Affected Product: Easergy P3 (All versions prior to V30.205)
Vulnerability class: Buffer Overflow
EPSS: 0.028 (84.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Schneider-electric Easergy_p3
- Schneider-electric Easergy_p3_firmware
- N/a Easergy P3 (All Versions Prior To V30.205) — versions Easergy P3 (All versions prior to V30.205)
Weakness classification (CWE)
References
- cybersecurity@se.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22725?
- CVE-2022-22725 is a high-severity vulnerability in Schneider-Electric Easergy P3, classified under Buffer Copy without Checking Size of Input (Classic Buffer Overflow). CVSS score: 8.8/10. Published 2022-02-04.
- How severe is CVE-2022-22725?
- High severity. CVSS v3 base score is 8.8 out of 10.