"Schneider Power Meter Vulnerability Opens Door to Power Outages"

A security vulnerability was recently discovered in the Schneider Electric ION and PowerLogic power meters.  The vulnerability makes it so they transmit a user ID and password in plaintext with every message.  The vulnerability was given a CVSS vulnerability severity rating of 8.8 out of 10.  The bug would allow an attacker with passive interception capabilities to obtain these credentials, authenticate to the ION/TCP engineering interface (as well as SSH and HTTP interfaces), and change configuration settings or potentially modify the firmware.  A security researcher at Forescout stated that it is obviously not acceptable anymore for an operational technology (OT) product to transmit credentials in cleartext because anybody that has access to the network and can sniff the traffic will be able to get them and then do almost whatever they want with the device.  The researcher noted that this could include controlling smart meter switches to cause load oscillations that could trigger shutdowns, with the demand (or load) then being passed on to other parts of the grid network.  In a worst-case scenario, a domino effect could theoretically lead to a blackout.

Dark Reading reports: "Schneider Power Meter Vulnerability Opens Door to Power Outages"