Cyber Resilience

CVE-2021-22763

CriticalUpdated

Published: 11 June 2021

Published
11 June 2021
Modified
29 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0027 50.5th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2021-22763 is a critical-severity Weak Password Recovery Mechanism for Forgotten Password (CWE-640) vulnerability in Schneider-Electric Powerlogic Pm5560 Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 49.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A CWE-640: Weak Password Recovery Mechanism for Forgotten Password vulnerability exists in PowerLogic PM55xx, PowerLogic PM8ECC, PowerLogic EGX100 and PowerLogic EGX300 (see security notification for version infromation) that could allow an attacker administrator level access to a device.

CWE(s)
CWE-640

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

schneider-electric
powerlogic pm5560 firmware
≤ 2.7.8
schneider-electric
powerlogic pm5561 firmware
≤ 10.7.3
schneider-electric
powerlogic pm5562 firmware
≤ 2.5.4
schneider-electric
powerlogic pm5563 firmware
≤ 2.7.8
schneider-electric
powerlogic pm8ecc firmware
all versions

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

IA-5 Authenticator Management
addresses: CWE-640

Establishing procedures for lost or compromised authenticators addresses weak password recovery mechanisms.

References