CVE-2022-22722 is a hard-coded-credentials flaw (CWE-798) in Schneider Electric's Easergy P5, a bay controller and protection relay for medium/high-voltage substations: firmware prior to V01.401.101 embeds the same SSH cryptographic key across devices, so an attacker who extracts that key and reaches a unit's local operational network could observe and manipulate its configuration traffic, and NVD rates the impact 7.5 (high) on CVSS v3.1.
Vulnerability summary
7.5
High
2.4%
EPSS score (FIRST)
No
CISA KEV catalog
2022-02-04
Published
Vulnerability ID: CVE-2022-22722 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Schneider Electric Easergy P5 protection relay | cpe:2.3:o:schneider-electric:easergy_p5_firmware:*:*:*:*:*:*:*:* | Easergy P5, all firmware versions prior to V01.401.101, per NVD; CISA ICSA-22-055-03 (Update A) covers this alongside related Easergy P5/P3 flaws |
What does this mean for affected devices?
CVE-2022-22722 (CWE-798, Use of Hard-coded Credentials) affects the Schneider Electric Easergy P5, a protection and bay-control relay marketed for medium-voltage, high-voltage and extra-high-voltage substation applications.
NVD's description states: "A CWE-798: Use of Hard-coded Credentials vulnerability exists that could result in information disclosure. If an attacker were to obtain the SSH cryptographic key for the device and take active control of the local operational network connected to the product they could potentially observe and manipulate traffic associated with product configuration. Affected Product: Easergy P5 (All firmware versions prior to V01.401.101)" (NVD).
NVD records a Primary CVSS v3.1 score of 7.5 (high), vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H — the attack requires adjacent-network access (AV:A) and high attack complexity (AC:H) — consistent with needing to first obtain the shared key and reach the device's local operational network — but no privileges or user interaction beyond that, with full confidentiality, integrity and availability impact once achieved (NVD).
The flaw is tracked in CISA's ICS advisory ICSA-22-055-03 ("Schneider Electric Easergy P5 and P3", Update A), which groups it with three related flaws disclosed in the same Easergy P5/P3 firmware: CVE-2022-22723 and CVE-2022-22725 (both CVSS 8.8 buffer overflows that can cause denial of service or full relay compromise) and CVE-2022-34758 (CVSS 5.1, a privileged-user watchdog-disable issue). CISA's risk evaluation states that successful exploitation of these vulnerabilities "may disclose device credentials, cause a denial-of-service condition, device reboot, or allow an attacker to gain full control of the relay," which "could result in loss of protection to your electrical network" (CISA ICSA-22-055-03).
Schneider Electric published its own security notification for this issue, document reference SEVD-2022-011-03, cited by NVD as the vendor patch/advisory reference (Schneider Electric Security Notification SEVD-2022-011-03).
This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 2.37% (83.9th percentile) as of 2026-11-08 (CISA KEV, FIRST EPSS).
Operators running Easergy P5 firmware prior to V01.401.101 should apply Schneider Electric's remediation per SEVD-2022-011-03 and review the full ICSA-22-055-03 advisory, since the same bulletin covers higher-severity companion flaws in Easergy P5 and P3 relays.
Evidence
- A CWE-798 Use of Hard-coded Credentials vulnerability in Easergy P5 firmware prior to V01.401.101: an attacker who obtains the SSH cryptographic key and takes active control of the device's local operational network could observe and manipulate traffic associated with product configuration. — NVD
- NVD Primary CVSS v3.1 score 7.5 (high), vector CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. — NVD
- CISA ICS advisory ICSA-22-055-03 (Update A) groups CVE-2022-22722 with CVE-2022-22723, CVE-2022-22725 and CVE-2022-34758 in Easergy P5/P3 relays, and states exploitation may disclose device credentials, cause denial of service or device reboot, or allow full control of the relay, risking loss of protection to the electrical network. — CISA ICSA-22-055-03
- Schneider Electric published security notification SEVD-2022-011-03 covering this Easergy P5 vulnerability, cited by NVD as the vendor patch reference. — Schneider Electric Security Notification SEVD-2022-011-03
- Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 2.37% (83.9th percentile) as of 2026-11-08. — FIRST EPSS
Questions about this page?
Related advisories
Sources
Frequently asked questions
What is actually hard-coded in the Easergy P5, and why does that matter?
The relay's firmware embeds the same SSH cryptographic key across devices rather than generating a unique one per unit, so an attacker who extracts that key from one Easergy P5 can use it to access the SSH session of any other unit running the same vulnerable firmware (per NVD).
What access does an attacker need before they can exploit this?
NVD's vector requires adjacent-network access (AV:A) and high attack complexity (AC:H) — the attacker needs to first obtain the shared SSH key and reach the device's local operational network, not just send a request from anywhere on the internet (per NVD).
What can an attacker do once they have exploited it?
They can observe and manipulate traffic associated with the relay's configuration — NVD's full confidentiality, integrity and availability impact (C:H/I:H/A:H) reflects that this goes beyond passive eavesdropping to active tampering with configuration data (per NVD).
Is this the only vulnerability in the Easergy P5/P3 advisory?
No — CISA's ICSA-22-055-03 (Update A) also lists CVE-2022-22723 and CVE-2022-22725 (both 8.8, buffer overflows) and CVE-2022-34758 (5.1), and warns that collectively these flaws could let an attacker disclose credentials, cause a denial-of-service or reboot, or gain full control of the relay, risking loss of protection to the electrical network (per CISA ICSA-22-055-03).