# Schneider Electric P7 flaws enable command injection, DoS

Published: 2026-06-25 · Severity: high · Sectors: energy, infrastructure
Canonical: https://vorant.io/reports/7be7fb35-4d5b-5f37-9c75-19188e4bc50d/schneider-electric-p7-flaws-enable-command-injection-dos

> Three vulnerabilities in Schneider Electric PowerLogic P7 protection and control systems allow command injection and denial-of-service attacks against industrial networks.

Schneider Electric disclosed three vulnerabilities in its PowerLogic P7 protection and control platform, which is deployed worldwide in commercial facilities, critical manufacturing, and energy sectors. The flaws affect version 0.2.003.001.000 and prior. CVE-2026-9717, the most severe issue, is an OS command injection vulnerability that allows authenticated attackers with elevated privileges to execute arbitrary commands, compromising system integrity, confidentiality, and availability. CVE-2026-9716 and CVE-2026-9718 enable denial-of-service conditions through NULL pointer dereference and reachable assertion flaws, which can render the device's HMI and configuration functionality inoperable when malformed or specially crafted requests are sent to exposed network interfaces.

Schneider Electric released firmware version V02.004.001 to address all three vulnerabilities, available through their Customer Care Center. Organizations that cannot immediately patch should restrict network access to P7 service endpoints on ports 8080 and 3702, monitor for anomalous SOAP requests targeting wsApp, and apply least-privilege principles for administrative access. Given the industrial control system context and potential for loss of control over critical operations, affected organizations should prioritize remediation. The vulnerabilities were reported by Schneider Electric's CPCERT and Cytrics.

## Mentioned in this report

- Vulnerabilities: CVE-2026-9716, CVE-2026-9717, CVE-2026-9718

## Detection guidance (public sample)

### Potential OS Command Injection via SOAP Request to P7 wsApp Endpoint

ATT&CK: T1059

Detects HTTP/SOAP requests to the PowerLogic P7 wsApp endpoint containing shell metacharacters consistent with OS command injection attempts (CVE-2026-9717). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Potential OS Command Injection via SOAP Request to P7 wsApp Endpoint
id: 49ccfe53-a85f-5c0f-8439-0d67353edd10
status: experimental
description: Detects HTTP/SOAP requests to the PowerLogic P7 wsApp endpoint that contain
  shell metacharacters or command-injection sequences, consistent with exploitation
  of CVE-2026-9717 which allows authenticated command injection on P7 protection and
  control devices.
references:
- Schneider Electric PowerLogic P7 advisory (CVE-2026-9717, CVE-2026-9716, CVE-2026-9718)
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: wsApp
  injection_chars:
    c-uri|contains:
    - ;
    - '|'
    - '`'
    - $(
    - '&&'
    - ../
  port_filter:
    dst_port:
    - 8080
    - 3702
  condition: selection and injection_chars and port_filter
fields:
- src_ip
- dst_ip
- dst_port
- c-uri
- http_method
falsepositives:
- Legitimate automated test or scanning tools that pass special characters as part
  of parameter fuzzing during authorized vulnerability assessments
- Application health-check scripts that include URL-encoded punctuation in SOAP payloads
level: high
tags:
- attack.t1059
- attack.execution
- cve.2026-9717
author: Vorant
```

### Repeated Malformed SOAP Requests to P7 Device Causing Service Disruption

ATT&CK: T1489

Detects a pattern of malformed or error-inducing SOAP requests to the P7 wsApp endpoint that may trigger NULL pointer dereference or assertion-based denial of service (CVE-2026-9716/9718). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Repeated Malformed SOAP Requests to P7 Device Causing Service Disruption
id: 8b8ddd3e-0e83-5730-916f-657b225136b0
status: experimental
description: Detects HTTP/SOAP requests to the PowerLogic P7 wsApp endpoint that receive
  server error responses (5xx) or malformed content-length mismatches, which may indicate
  exploitation attempts of the NULL pointer dereference or reachable assertion DoS
  flaws (CVE-2026-9716, CVE-2026-9718) affecting HMI and configuration availability.
  Consider correlating multiple occurrences from the same source within a short window
  as higher-confidence evidence of active exploitation, since a single event alone
  is not conclusive.
references:
- Schneider Electric PowerLogic P7 advisory (CVE-2026-9716, CVE-2026-9718)
logsource:
  category: proxy
detection:
  selection:
    c-uri|contains: wsApp
    dst_port:
    - 8080
    - 3702
  error_response:
    sc-status:
    - 500
    - 502
    - 503
  condition: selection and error_response
fields:
- src_ip
- dst_ip
- dst_port
- c-uri
- sc-status
falsepositives:
- Network instability or misconfigured load balancers causing legitimate 5xx responses
  from the device web server
- Vulnerability scanners or authorized penetration testers probing the endpoint during
  scheduled assessments
level: medium
tags:
- attack.t1489
- attack.impact
- cve.2026-9716
- cve.2026-9718
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-176-07

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/7be7fb35-4d5b-5f37-9c75-19188e4bc50d/schneider-electric-p7-flaws-enable-command-injection-dos.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup