CVE-2016-5809: CSRF
First published: Mon Feb 13 2017(Updated: )
An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. There is no CSRF Token generated to authenticate the user during a session. Successful exploitation of this vulnerability can allow unauthorized configuration changes to be made and saved.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Schneider-electric Ion5000 | ||
| Schneider-electric Ion7300 | ||
| Schneider Electric Ion7500 | ||
| Schneider Electric ION7600 | ||
| Schneider-electric Ion8650 Firmware | ||
| Schneider-electric Ion8800 Firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-5809?
CVE-2016-5809 is considered to have a medium severity due to the lack of CSRF token, which may allow unauthorized actions during a user session.
How do I fix CVE-2016-5809?
To fix CVE-2016-5809, implement a CSRF token validation mechanism in your application's session management.
Which Schneider Electric devices are affected by CVE-2016-5809?
CVE-2016-5809 affects the Schneider Electric ION5000, ION7300, ION7500, ION7600, ION8650, and ION8800 series of power meters.
Can CVE-2016-5809 lead to unauthorized access?
Yes, successful exploitation of CVE-2016-5809 can allow an attacker to perform actions without proper authentication.
What type of attack is enabled by CVE-2016-5809?
CVE-2016-5809 enables Cross-Site Request Forgery (CSRF) attacks due to the absence of CSRF token validation.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/references
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/schneider-electric ion5000
- canonical/schneider-electric ion7300
- canonical/schneider electric ion7500
- canonical/schneider electric ion7600
- canonical/schneider-electric ion8650 firmware
- canonical/schneider-electric ion8800 firmware