Schneider Electric P7 flaws enable command injection, DoS
Three vulnerabilities in Schneider Electric PowerLogic P7 protection and control systems allow command injection and denial-of-service attacks against industrial networks.
Schneider Electric disclosed three vulnerabilities in its PowerLogic P7 protection and control platform, which is deployed worldwide in commercial facilities, critical manufacturing, and energy sectors. The flaws affect version 0.2.003.001.000 and prior. CVE-2026-9717, the most severe issue, is an OS command injection vulnerability that allows authenticated attackers with elevated privileges to execute arbitrary commands, compromising system integrity, confidentiality, and availability. CVE-2026-9716 and CVE-2026-9718 enable denial-of-service conditions through NULL pointer dereference and reachable assertion flaws, which can render the device's HMI and configuration functionality inoperable when malformed or specially crafted requests are sent to exposed network interfaces.
Schneider Electric released firmware version V02.004.001 to address all three vulnerabilities, available through their Customer Care Center. Organizations that cannot immediately patch should restrict network access to P7 service endpoints on ports 8080 and 3702, monitor for anomalous SOAP requests targeting wsApp, and apply least-privilege principles for administrative access. Given the industrial control system context and potential for loss of control over critical operations, affected organizations should prioritize remediation. The vulnerabilities were reported by Schneider Electric's CPCERT and Cytrics.
Mentioned in this report
Detection guidance
Potential OS Command Injection via SOAP Request to P7 wsApp Endpoint
Detects HTTP/SOAP requests to the PowerLogic P7 wsApp endpoint containing shell metacharacters consistent with OS command injection attempts (CVE-2026-9717). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential OS Command Injection via SOAP Request to P7 wsApp Endpoint
id: 49ccfe53-a85f-5c0f-8439-0d67353edd10
status: experimental
description: Detects HTTP/SOAP requests to the PowerLogic P7 wsApp endpoint that contain
shell metacharacters or command-injection sequences, consistent with exploitation
of CVE-2026-9717 which allows authenticated command injection on P7 protection and
control devices.
references:
- Schneider Electric PowerLogic P7 advisory (CVE-2026-9717, CVE-2026-9716, CVE-2026-9718)
logsource:
category: proxy
detection:
selection:
c-uri|contains: wsApp
injection_chars:
c-uri|contains:
- ;
- '|'
- '`'
- $(
- '&&'
- ../
port_filter:
dst_port:
- 8080
- 3702
condition: selection and injection_chars and port_filter
fields:
- src_ip
- dst_ip
- dst_port
- c-uri
- http_method
falsepositives:
- Legitimate automated test or scanning tools that pass special characters as part
of parameter fuzzing during authorized vulnerability assessments
- Application health-check scripts that include URL-encoded punctuation in SOAP payloads
level: high
tags:
- attack.t1059
- attack.execution
- cve.2026-9717
author: Vorant
Repeated Malformed SOAP Requests to P7 Device Causing Service Disruption
Detects a pattern of malformed or error-inducing SOAP requests to the P7 wsApp endpoint that may trigger NULL pointer dereference or assertion-based denial of service (CVE-2026-9716/9718). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Malformed SOAP Requests to P7 Device Causing Service Disruption
id: 8b8ddd3e-0e83-5730-916f-657b225136b0
status: experimental
description: Detects HTTP/SOAP requests to the PowerLogic P7 wsApp endpoint that receive
server error responses (5xx) or malformed content-length mismatches, which may indicate
exploitation attempts of the NULL pointer dereference or reachable assertion DoS
flaws (CVE-2026-9716, CVE-2026-9718) affecting HMI and configuration availability.
Consider correlating multiple occurrences from the same source within a short window
as higher-confidence evidence of active exploitation, since a single event alone
is not conclusive.
references:
- Schneider Electric PowerLogic P7 advisory (CVE-2026-9716, CVE-2026-9718)
logsource:
category: proxy
detection:
selection:
c-uri|contains: wsApp
dst_port:
- 8080
- 3702
error_response:
sc-status:
- 500
- 502
- 503
condition: selection and error_response
fields:
- src_ip
- dst_ip
- dst_port
- c-uri
- sc-status
falsepositives:
- Network instability or misconfigured load balancers causing legitimate 5xx responses
from the device web server
- Vulnerability scanners or authorized penetration testers probing the endpoint during
scheduled assessments
level: medium
tags:
- attack.t1489
- attack.impact
- cve.2026-9716
- cve.2026-9718
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-07
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free