EUVD-2026-39434
GHSA-47f2-rprg-7x63
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable management service (AV:N) with low complexity (AC:L) but requiring an existing privileged account (PR:H); injected commands run with elevated privileges yielding full C/I/A impact.
Primary rating from Vendor (schneider).
CVSS VectorVendor: schneider
Lifecycle Timeline
1DescriptionCVE.org
CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts with a vulnerable network-exposed service.
AnalysisAI
Authenticated command injection in Schneider Electric PowerLogic P7 power metering devices allows a privileged user to execute arbitrary OS commands with elevated privileges over a network-exposed service, fully compromising device integrity, confidentiality, and availability. The flaw (CWE-78) stems from improper neutralization of special elements passed to an underlying OS command. No public exploit identified at time of analysis, and the device is not listed in CISA KEV; EPSS data was not provided.
Technical ContextAI
PowerLogic P7 is a high-end power metering and monitoring device used in electrical distribution and energy management installations. The root cause is CWE-78 (OS Command Injection): user-controllable input reaches an operating-system command interpreter without adequate sanitization, so crafted input is interpreted as additional shell commands rather than inert data. Because the vulnerable function runs as a privileged process on the device firmware, injected commands execute with elevated privileges. The affected product is identified by CPE cpe:2.3:a:schneider_electric:powerlogic™_p7:*:*:*:*:*:*:*:* - the wildcard version field means specific affected firmware ranges are not enumerated in the provided data and must be confirmed from Schneider's advisory SEVD-2026-160-03.
RemediationAI
Apply the firmware fix specified in Schneider Electric advisory SEVD-2026-160-03 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-03.pdf); the exact patched firmware version is not included in the provided data and must be taken from that advisory. Patch available per vendor advisory. Until the device can be updated, reduce exposure of the management service: place the device on an isolated OT/management VLAN unreachable from corporate or internet zones, restrict access to the network service to a small set of trusted engineering workstations via firewall ACLs, and require unique strong credentials for all privileged accounts to raise the bar on the PR:H prerequisite (trade-off: tighter network segmentation may complicate legitimate remote monitoring and metering data collection). Audit and rotate privileged credentials and enable logging on the device's management interface to detect anomalous command activity. Since exploitation requires privileged authentication, removing default/shared admin accounts and enforcing least privilege materially lowers risk with minimal operational side effects.
More in Powerlogic P7
View allDenial-of-service in Schneider Electric PowerLogic P7 power metering devices allows remote, unauthenticated attackers to
Denial-of-service in Schneider Electric PowerLogic P7 power monitoring devices allows an authenticated attacker to crash
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today