EUVD-2026-75107
GHSA-49xv-xvfv-pf95
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local SSH access required with high-privilege authentication; root escalation changes scope, justifying S:C with full C/I/A impact.
Primary rating from Vendor (schneider).
CVSS VectorVendor: schneider
Lifecycle Timeline
2DescriptionCVE.org
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input.
AnalysisAI
Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three specific conditions must all be present: (1) SSH access must be enabled on the target PowerLogic T300 - if SSH is disabled, this attack path does not exist (AT:P in the CVSS 4.0 vector); (2) the attacker must possess authenticated credentials for a high-privilege account on the device (PR:H - this is not a pre-authentication exploit); (3) the attacker must have network-level reachability to the device's SSH port, which in typical OT deployments requires presence on the operational or management network segment. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.7 is anchored by PR:H and AT:P, reflecting two real-world barriers: the attacker must already hold high-privilege credentials, and SSH must be enabled on the device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary remediation is to apply the patch identified in Schneider Electric security advisory SEVD-2026-251-02, available at https://download.se.com/files?p_Doc_Ref=SEVD-2026-251-02. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Schneider Electric PowerLogic T300 devices and confirm which are running versions 2.9.8-5620 or earlier; immediately restrict SSH access to the minimum set of essential administrative users and enforce key-based authentication with strong passphrases instead of default credentials. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Powerlogic T300
View allSame weakness CWE-78 – OS Command Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today