Cleartext transmission of sensitive information in Schneider Electric PowerLogic ION9000
Priority MEDIUM 49CWE-319Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-319.
Summary
A CWE-319: Cleartext transmission of sensitive information vulnerability exists that could cause disclosure of sensitive information, denial of service, or modification of data if an attacker is able to intercept network traffic.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00379 32nd percentileScored 2026-11-07
Fix Fixed PowerLogic ION9000 (Schneider Electric): 4.0.0PowerLogic ION7400 (Schneider Electric): 4.0.0+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Schneider Electric | PowerLogic ION9000 | before 4.0.0 | 4.0.0 | Patch available | CNA |
| Schneider Electric | PowerLogic ION7400 | before 4.0.0 | 4.0.0 | Patch available | CNA |
| Schneider Electric | PowerLogic PM8000 | before 4.0.0 | 4.0.0 | Patch available | CNA |
| Schneider Electric | PowerLogic ION8650 | All Versions | — | No fix listed | CNA |
| Schneider Electric | PowerLogic ION8800 | All Versions | — | No fix listed | CNA |
| Schneider Electric | Legacy ION products | All Versions | — | No fix listed | CNA |
- PowerLogic ION9000 VendorSchneider Electric Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
- PowerLogic ION7400 VendorSchneider Electric Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
- PowerLogic PM8000 VendorSchneider Electric Affected before 4.0.0 Fixed in 4.0.0 Patch available CNA
- PowerLogic ION8650 VendorSchneider Electric Affected All Versions Fixed in — No fix listed CNA
- PowerLogic ION8800 VendorSchneider Electric Affected All Versions Fixed in — No fix listed CNA
- Legacy ION products VendorSchneider Electric Affected All Versions Fixed in — No fix listed CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:schneider-electric:powerlogic_ion9000_firmware:*:*:*:*:*:*:*:* | before 4.0.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:powerlogic_ion9000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:powerlogic_ion7400_firmware:*:*:*:*:*:*:*:* | before 4.0.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:powerlogic_ion7400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:powerlogic_pm8000_firmware:*:*:*:*:*:*:*:* | before 4.0.0 | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:powerlogic_pm8000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:powerlogic_ion8650_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:powerlogic_ion8650:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
| cpe:2.3:o:schneider-electric:powerlogic_ion8800_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Schneider Electric |
| cpe:2.3:h:schneider-electric:powerlogic_ion8800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Schneider Electric |
- cpe:2.3:o:schneider-electric:powerlogic_ion9000_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:powerlogic_ion9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:powerlogic_ion7400_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:powerlogic_ion7400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:powerlogic_pm8000_firmware:*:*:*:*:*:*:*:* Versions before 4.0.0 Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:powerlogic_pm8000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:powerlogic_ion8650_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:powerlogic_ion8650:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
- cpe:2.3:o:schneider-electric:powerlogic_ion8800_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Schneider Electric
- cpe:2.3:h:schneider-electric:powerlogic_ion8800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Schneider Electric
Remediation
- Fix · CNA PowerLogic ION9000 (Schneider Electric) Fixed in 4.0.0
- Fix · CNA PowerLogic ION7400 (Schneider Electric) Fixed in 4.0.0
- Fix · CNA PowerLogic PM8000 (Schneider Electric) Fixed in 4.0.0
Timeline
- 2026-10-02 Threatist record created from CVE-2022-46680
- 2026-10-03 Alias added: GHSA-fhxw-qvv7-c595
References
More Schneider Electric Powerlogic Ion7400 Firmware vulnerabilities
- TI-2021-05596 Memory corruption in PowerLogic ION7400, PM8000 and ION9000 CVSS 3.1CRITICAL 9.8
- TI-2021-05585 Cleartext transmission of sensitive information in PowerLogic ION7400, ION7650… CVSS 3.1HIGH 7.5
- TI-2021-05584 Cleartext transmission of sensitive information in PowerLogic ION7400, ION7650… CVSS 3.1HIGH 7.5
- TI-2021-05583 Cross-site request forgery in PowerLogic ION7400, ION7650, ION83xx/84xx/85xx/8600… CVSS 3.1MEDIUM 6.1
Sources
- CVE-2022-46680 · CVE Program
- CVE-2022-46680 · NVD
- FIRST EPSS
- GHSA-fhxw-qvv7-c595 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences