CISA republishes Schneider Electric advisory on session-hijacking flaw
CISA republished a Schneider Electric industrial control systems advisory on Sept. 3 about a high-severity authentication flaw in multiple product lines.
CISA on Sept. 3 republished a Schneider Electric advisory about a vulnerability in multiple industrial control products that could allow unauthorized access if exploited on a network.
The issue, tracked as CVE-2026-4827 and classified as CWE-331, involves insufficient entropy, or weak randomness, in session-management protections. CISA said failure to apply the fix may increase the risk of session hijacking, which could let an attacker perform unauthorized operations within an affected system.
The advisory assigns the flaw a CVSS v3.1 base score of 8.3 and rates it high. CISA said the affected products include Easergy C5; Easergy MiCOM P30 and P40; Easergy MiCOM C264; EcoStruxure Power Automation System Gateway, or EPAS-GTW; EcoStruxure Power Automation System User Interface, or EPAS-UI; EcoStruxure Power Operation, or EPO; iPMFLS; PowerLogic P5; PowerLogic P7; PowerLogic T300; PowerLogic T500; Saitel DP; and EasyLogic T150, formerly Saitel DR.
The agency’s notice lists affected versions for each product family and says fixes are available for many of them. Examples include Easergy MiCOM C264 D7.34; Easergy C5 1.1.18; EPAS-GTW 6.4.610.500.101; EPAS-UI 3.0.4; EPO 2022 CU7 and 2024 CU3; iPMFLS 64.2025.0.14; PowerLogic P5 V02.503.101; PowerLogic P7 V02.003.001; PowerLogic T300 2.9.5; PowerLogic T500 11.08.03; and CPU866e firmware 11.06.37. CISA said some fixes require a reboot to complete the firmware update.
For several Easergy MiCOM P30 and P40 products, Schneider Electric said it is working on future remediation. Until then, the company advised placing those systems on physically or logically segmented internal networks, limiting access with firewalls and intrusion detection systems, and reducing the “Minimum inactivity period” through the CAE tool to shorten session timeouts.
CISA said the products are deployed worldwide and identified critical infrastructure sectors including Chemical, Critical Manufacturing, Energy, and Water and Wastewater. The advisory says an internal Schneider Electric researcher reported the issue to CISA.
The revision history shows initial publication on May 12, 2026, republication on June 18, 2026, and Update A on Sept. 3, 2026. CISA said the update revised the summary to reflect affected products.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
This is the AMP version of the article. Read the full article on Atlas Watchline.