Vulnerability in Schneider-Electric Hmibscea53d1edb
CVE-2022-22807
A CWE-1021 Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause unintended modifications of the product settings or user accounts when deceiving the user to use the web interface rendered within iframes. Affected Product: EcoStruxure EV Charging Expert (formerly known as EVlink Load Management System): (HMIBSCEA53D1EDB, HMIBSCEA53D1EDS, HMIBSCEA53D1EDM, HMIBSCEA53D1EDL, HMIBSCEA53D1ESS, HMIBSCEA53D1ESM, HMIBSCEA53D1EML) (All Versions prior to SP8 (Version 01) V4.0.0.13)
EPSS: 0.009 (57.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N.
Affected products
- Schneider-electric Hmibscea53d1edb
- Schneider-electric Hmibscea53d1edb_firmware
- Schneider-electric Hmibscea53d1edl
- Schneider-electric Hmibscea53d1edl_firmware
- Schneider-electric Hmibscea53d1edm
- Schneider-electric Hmibscea53d1edm_firmware
- Schneider-electric Hmibscea53d1eds
- Schneider-electric Hmibscea53d1eds_firmware
- Schneider-electric Hmibscea53d1eml
- Schneider-electric Hmibscea53d1eml_firmware
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cybersecurity@se.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2022-22807?
- CVE-2022-22807 is a high-severity vulnerability in Schneider-Electric Hmibscea53d1edb, classified under Improper Restriction of Rendered UI Layers or Frames (Clickjacking). CVSS score: 7.4/10. Published 2022-02-09.
- How severe is CVE-2022-22807?
- High severity. CVSS v3 base score is 7.4 out of 10.
- Is CVE-2022-22807 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.