Schneider Electric P7 flaws enable command injection, DoS
Three vulnerabilities in Schneider Electric PowerLogic P7 protection and control systems allow command injection and denial-of-service attacks against industrial networks.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 3 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
Schneider Electric disclosed three vulnerabilities in its PowerLogic P7 protection and control platform, which is deployed worldwide in commercial facilities, critical manufacturing, and energy sectors. The flaws affect version 0.2.003.001.000 and prior. CVE-2026-9717, the most severe issue, is an OS command injection vulnerability that allows authenticated attackers with elevated privileges to execute arbitrary commands, compromising system integrity, confidentiality, and availability. CVE-2026-9716 and CVE-2026-9718 enable denial-of-service conditions through NULL pointer dereference and reachable assertion flaws, which can render the device's HMI and configuration functionality inoperable when malformed or specially crafted requests are sent to exposed network interfaces.
Schneider Electric released firmware version V02.004.001 to address all three vulnerabilities, available through their Customer Care Center. Organizations that cannot immediately patch should restrict network access to P7 service endpoints on ports 8080 and 3702, monitor for anomalous SOAP requests targeting wsApp, and apply least-privilege principles for administrative access. Given the industrial control system context and potential for loss of control over critical operations, affected organizations should prioritize remediation. The vulnerabilities were reported by Schneider Electric's CPCERT and Cytrics.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-07
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs