Schneider Electric PowerLogic PM55xx and PowerLogic PM8ECC

An attacker could gain elevated privileges on power metering devices, potentially altering energy consumption data, disabling alarms, or taking control of the meter's operations. This could affect billing accuracy and operational visibility into electrical distribution systems.

Energy utilities and facilities with Schneider Electric PowerLogic PM55xx power metering devices (PM5560, PM5561, PM5562, PM5563) and PM8ECC ethernet communication modules should be concerned. These devices are used for electrical consumption monitoring and data collection in substations, distribution centers, and large facilities. Any organization relying on accurate power metering data for billing, load management, or operational monitoring is affected.

An attacker with network access to the device can exploit the privilege elevation vulnerability to gain elevated privileges without authentication. The vulnerability is reachable over HTTP, allowing remote exploitation from the network. Once exploited, the attacker gains control of the metering device.