{"api_version":"1","generated_at":"2026-07-23T08:43:58+00:00","cve":"CVE-2016-5815","urls":{"html":"https://cve.report/CVE-2016-5815","api":"https://cve.report/api/cve/CVE-2016-5815.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-5815","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-5815"},"summary":{"title":"CVE-2016-5815","description":"An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes.","state":"PUBLISHED","assigner":"icscert","published_at":"2017-02-13 21:59:00","updated_at":"2025-04-20 01:37:25"},"problem_types":["CWE-284","Schneider Electric IONXXXX Series Power Meter Vulnerabilities"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"9.8","severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03","name":"https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","US Government Resource"],"title":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities | ICS-CERT","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/94091","name":"http://www.securityfocus.com/bid/94091","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory","VDB Entry"],"title":"Schneider Electric ION CVE-2016-5815 Series Security Bypass Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-5815","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-5815","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities","version":"affected Schneider Electric IONXXXX Series Power Meter Vulnerabilities","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"5815","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"schneider-electric","cpe5":"ion5000","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5815","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"schneider-electric","cpe5":"ion7300","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5815","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"schneider-electric","cpe5":"ion7500","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5815","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"schneider-electric","cpe5":"ion7600","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5815","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"schneider-electric","cpe5":"ion8650","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"5815","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"schneider-electric","cpe5":"ion8800","cpe6":"-","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T01:15:09.863Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"94091","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/94091"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities","vendor":"n/a","versions":[{"status":"affected","version":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities"}]}],"datePublic":"2017-02-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes."}],"problemTypes":[{"descriptions":[{"description":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-02-14T10:57:01.000Z","orgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","shortName":"icscert"},"references":[{"name":"94091","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/94091"},{"tags":["x_refsource_MISC"],"url":"https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"ics-cert@hq.dhs.gov","ID":"CVE-2016-5815","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities","version":{"version_data":[{"version_value":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Schneider Electric IONXXXX Series Power Meter Vulnerabilities"}]}]},"references":{"reference_data":[{"name":"94091","refsource":"BID","url":"http://www.securityfocus.com/bid/94091"},{"name":"https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03","refsource":"MISC","url":"https://ics-cert.us-cert.gov/advisories/ICSA-16-308-03"}]}}}},"cveMetadata":{"assignerOrgId":"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6","assignerShortName":"icscert","cveId":"CVE-2016-5815","datePublished":"2017-02-13T21:00:00.000Z","dateReserved":"2016-06-23T00:00:00.000Z","dateUpdated":"2024-08-06T01:15:09.863Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2017-02-13 21:59:00","lastModifiedDate":"2025-04-20 01:37:25","problem_types":["CWE-284","Schneider Electric IONXXXX Series Power Meter Vulnerabilities"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:schneider-electric:ion5000:-:*:*:*:*:*:*:*","matchCriteriaId":"B0DA1F9F-A898-4059-93FB-05F5C28280E1"},{"vulnerable":true,"criteria":"cpe:2.3:h:schneider-electric:ion7300:-:*:*:*:*:*:*:*","matchCriteriaId":"5DD65F3D-EB57-4AB3-BB33-81B42D460AC4"},{"vulnerable":true,"criteria":"cpe:2.3:h:schneider-electric:ion7500:-:*:*:*:*:*:*:*","matchCriteriaId":"9DC9074B-EA61-4D44-8A16-9E117138629A"},{"vulnerable":true,"criteria":"cpe:2.3:h:schneider-electric:ion7600:-:*:*:*:*:*:*:*","matchCriteriaId":"CFC7C001-9AB5-453F-BC3B-5544627B06CF"},{"vulnerable":true,"criteria":"cpe:2.3:h:schneider-electric:ion8650:-:*:*:*:*:*:*:*","matchCriteriaId":"1DA97CA0-DDE0-4418-9D72-7D463C003693"},{"vulnerable":true,"criteria":"cpe:2.3:h:schneider-electric:ion8800:-:*:*:*:*:*:*:*","matchCriteriaId":"B3449157-3715-4D89-A3BD-49EE47160B25"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"5815","Ordinal":"1","Title":"CVE-2016-5815","CVE":"CVE-2016-5815","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"5815","Ordinal":"1","NoteData":"An issue was discovered on Schneider Electric IONXXXX series power meters ION73XX series, ION75XX series, ION76XX series, ION8650 series, ION8800 series, and PM5XXX series. No authentication is configured by default. An unauthorized user can access the device management portal and make configuration changes.","Type":"Description","Title":"CVE-2016-5815"},{"CveYear":"2016","CveId":"5815","Ordinal":"2","NoteData":"2017-02-13","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"5815","Ordinal":"3","NoteData":"2017-02-14","Type":"Other","Title":"Modified"}]}}}