Schneider Electric Industrial Protection Relays CVE-2026-4827

Requires legitimate user to initiate authenticated session via web interface (UI:P in CVSS vector) - exploitation timing depends on operator login schedules in industrial environments (typically shift changes, maintenance windows, or alarm response events). Vulnerable products must have web management interfaces enabled and network-accessible to attacker (AV:N) - relays configured for serial-only access or completely air-gapped from attacker networks are not exploitable. Default configurations of all affected Schneider Electric products include web interfaces enabled on standard ports (HTTP 80/443), satisfying exploitation prerequisites without special setup. Attack complexity is low (AC:L) once user session exists - no race conditions, cryptographic bypass, or state manipulation required beyond standard session token prediction techniques. No authentication required for the attack itself (PR:N), as attacker bypasses authentication by predicting tokens rather than stealing credentials. What limits exploitation: Completely air-gapped OT networks with no IP connectivity to attacker position, relays configured with web interface fully disabled (requires manual configuration change), or deployments using external authentication gateways that regenerate session tokens with cryptographic-grade entropy (non-default third-party SSO integration).

Real-world risk is elevated despite absence from CISA KEV. CVSS 8.7 with AV:N/AC:L/PR:N indicates remote exploitation with low complexity once user interaction occurs. The UI:P requirement means attackers must wait for legitimate administrators to authenticate, then predict their session tokens - feasible in industrial environments with periodic operator logins or always-logged-in HMI panels. High confidentiality and integrity impact (VC:H/VI:H) reflects full control over relay configurations, SCADA data access, and ability to manipulate protective relay settings in electrical substations. The Authentication Bypass tag confirms session hijacking bypasses credential controls entirely. Critical factors elevating priority: (1) Operational technology deployment in power generation/distribution where relay misconfiguration causes outages or safety incidents, (2) 36 affected product variants suggest widespread vulnerable install base, (3) Low attack complexity enables less-skilled adversaries once initial recon identifies active sessions, (4) Network attack vector exposes internet-facing or contractor-accessible OT networks. Mitigating factors: User interaction required means fully air-gapped systems with console-only access reduce exposure; no public POC identified limits script-kiddie exploitation. However, targeted nation-state or ransomware groups routinely exploit OT web interfaces. Patch availability (vendor advisory SEVD-2026-132-02) shifts priority to urgent deployment timeline verification.

Industrial network reconnaissance identifies Schneider Electric PowerLogic P7 relay web interface at 10.50.10.15. Attacker monitors for active user sessions via timing analysis of HTTP responses. When substation operator logs in at 0600 shift change, attacker captures session establishment patterns (cookie length, format, timestamp correlation). Using weak PRNG characteristics, attacker generates candidate session tokens matching observed entropy profile. Within token validity window (default 30-60 minutes), attacker replays predicted token in Cookie header, hijacks operator session without credentials, and modifies protective relay trip settings to disable fault protection on critical 138kV transmission line. Publicly available exploit code not identified, but session prediction techniques are well-documented in penetration testing frameworks.