PowerLogic P7 EUVD-2026-39435

Q: What is the CVSS score of EUVD-2026-39435?

EUVD-2026-39435 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

| CVE-2026-9718 MEDIUM

Reachable Assertion (CWE-617)

2026-06-25 schneider

GHSA-78h5-xc8j-448r

Denial Of Service Schneider Electric Powerlogic P7

6.9

CVSS 4.0 · Vendor: schneider

Severity by source

Vendor (schneider) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.9 MEDIUM

Network vector with high-privilege auth required (PR:H); availability-only impact with no confidentiality or integrity exposure and unchanged scope.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (schneider).

CVSS VectorVendor: schneider

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 16:20 vuln.today

DescriptionCVE.org

CWE-617 Reachable Assertion vulnerability exists that could allow an authenticated attacker to trigger a denial-of-service condition, impacting system availability when a specially crafted request is sent to a vulnerable network-exposed service.

AnalysisAI

Denial-of-service in Schneider Electric PowerLogic P7 power monitoring devices allows an authenticated attacker to crash a network-exposed service by sending a specially crafted request that triggers a reachable assertion (CWE-617), fully disrupting availability. The CVSS 4.0 score of 6.9 reflects the high-privilege prerequisite (PR:H) that constrains exploitation to actors with administrative credentials, while the availability impact is rated high (VA:H) with no confidentiality or integrity consequences. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.

Technical ContextAI

CWE-617 (Reachable Assertion) describes a code path in which an internal assertion statement - typically a developer-inserted sanity check - can be reached and triggered by attacker-controlled input, causing the process to abort rather than handle the condition gracefully. In the PowerLogic P7, a Schneider Electric industrial power monitoring unit, a network-exposed service fails to sanitize or bound-check input before evaluating such an assertion. The CPE string cpe:2.3:a:schneider_electric:powerlogic™_p7:*:*:*:*:*:*:*:* with a wildcard version field indicates the flaw spans the entire known product line. This is an OT/ICS-class device typically deployed in electrical distribution panels and substations, where service availability directly affects operational continuity.

RemediationAI

Consult Schneider Electric advisory SEVD-2026-160-03 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-03.pdf) for patched firmware versions - no exact fix version is independently confirmable from the available data. As compensating controls pending patching: restrict network access to the PowerLogic P7 management interface using firewall rules or VLAN segmentation to limit exposure to trusted OT management networks only; enforce least-privilege access by auditing and reducing the number of accounts holding high-privilege credentials to the device; implement session monitoring and alerting for anomalous authenticated request patterns targeting the device's network service. Note that network segmentation alone does not eliminate the risk if a threat actor already holds valid high-privilege credentials.