SEVD-2022-039-04

Schneider Electric is aware of multiple vulnerabilities in its spaceLYnk, Wiser For KNX, and fellerLYnk products. spaceLYnk is a centralized solution that reduces energy and maintenance costs, increases comfort and flexibility, and simplifies building management. Wiser for KNX ,formerly known as homeLYnk, products are personalized energy efficiency solutions, offering a complete system based on open protocols: KNX, Modbus, BACnet and IP. fellerLYnk offers more flexibility in visualization and trend recording as well as functions such as presence simulation or time switches that the end customer can easily manage. Failure to apply the remediations provided below may risk a Cross-Site Request Forgery (CSRF), Missing Authentication, rate limit, or Stored Cross-Site Scripting (XSS) attack which could result in exfiltrated data and unauthorized access. March 2022 Update: The CVSS score has been updated for CVE-2022-22811 and CVE-2022-22812