Schneider Electric Multiple Products Insufficient Entropy Vulnerability Allowing Unauthorized Access

A vulnerability exists in various Schneider Electric products due to insufficient entropy, which could lead to unauthorized access. This issue arises when an attacker on the network exploits weaknesses in session management protections. Affected products include the Easergy C5, Easergy MiCOM P30, Easergy MiCOM P40, Easergy MiCOM C264, EcoStruxure Power Automation System Gateway (EPAS-GTW), EcoStruxure Power Automation System User Interface (EPAS-UI), EcoStruxure Power Operation, PowerLogic P5, PowerLogic P7, PowerLogic T300, PowerLogic T500, Saitel DP, and EasyLogic T150, across several different versions and ranges.

Impact

Exploitation of this vulnerability could lead to session hijacking, allowing malicious actors to perform unauthorized operations within the affected system.

Remediation

Users can update to the latest versions of the affected products. For specific version details, refer to the Schneider Electric Security Notification SEVD-2026-132-02. After updating, a reboot is required to complete the process. If the update is not possible, apply recommended mitigations such as ensuring the device operates within a segmented internal network and reducing session timeout durations.