EUVD-2026-75107
GHSA-49xv-xvfv-pf95
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconObtain high-privilege SSH credentials via credential theft or lateral movement
-
DeliveryConnect to SSH-enabled PowerLogic T300 over network
-
ExploitAuthenticate to OS console with stolen credentials
-
InstallInject shell metacharacters into console input field
-
C2OS executes injected commands without sanitization
-
ExecuteAttacker achieves root shell on device
-
ImpactUnauthorized administrative control and potential ICS lateral movement
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization OS command sanitization, avoid shell exec
MITRE ATT&CK
2 techniques across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Three specific conditions must all be present: (1) SSH access must be enabled on the target PowerLogic T300 - if SSH is disabled, this attack path does not exist (AT:P in the CVSS 4.0 vector); (2) the attacker must possess authenticated credentials for a high-privilege account on the device (PR:H - this is not a pre-authentication exploit); (3) the attacker must have network-level reachability to the device's SSH port, which in typical OT deployments requires presence on the operational or management network segment. Limiting factors: PR:H credential requirement is a genuine barrier and rules out anonymous internet exploitation; SSH is often disabled or network-firewalled in hardened ICS deployments; and PowerLogic T300 devices are typically behind OT-specific network segmentation. The AT:P designation in CVSS 4.0 explicitly marks SSH enablement as a deployment-dependent precondition. |
| Impact | The CVSS 4.0 score of 8.7 is anchored by PR:H and AT:P, reflecting two real-world barriers: the attacker must already hold high-privilege credentials, and SSH must be enabled on the device. These constraints meaningfully limit opportunistic exploitation compared to pre-authentication network-facing vulnerabilities. That said, even a mid-sized municipal utility operator in gniezno should treat this as urgent because OT credential hygiene is often weak, SSH is frequently left enabled on metering devices for maintenance, and root-level compromise of a power monitoring device in a segmented ICS network can facilitate lateral movement or data manipulation affecting billing, load monitoring, or grid visibility. No EPSS score is present in the provided intelligence, and no CISA KEV listing or public PoC exists at time of analysis - meaning this is elevated-risk but not confirmed exploited-in-the-wild. The subsequent-system impact scores (SC:H/SI:H/SA:H) are the key differentiator: they reflect the ICS context where compromise of this device is not self-contained. |
| Exploit ScenarioDerived | An attacker who has obtained valid high-privilege credentials for a PowerLogic T300 - through credential theft, phishing of an OT engineer, or lateral movement from a compromised maintenance workstation - establishes an SSH session to the device. By supplying shell metacharacters (such as semicolons or command substitution syntax) within console input fields, the attacker causes the OS to execute injected commands in the context of a privileged process, achieving root-level shell access. No public PoC is known, but CWE-78 injection techniques are well-documented and straightforward to apply once authenticated access is in hand. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 09, 2026
Privilege escalation to root in Schneider Electric PowerLogic T300 (versions 2.9.8-5620 and prior) is achievable by an authenticated SSH user through OS command injection in the device's operating system console. An attacker with high-privilege SSH access can inject shell metacharacters into user-controlled console input that the device fails to properly sanitize, breaking out of the intended command context to execute arbitrary commands as root and perform unauthorized administrative operations. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 8.7 reflects subsequent-system impact rated High, consistent with the device's ICS/energy-metering deployment context.
RemediationAI
The primary remediation is to apply the patch identified in Schneider Electric security advisory SEVD-2026-251-02, available at https://download.se.com/files?p_Doc_Ref=SEVD-2026-251-02. The exact patched firmware version is not specified in the available intelligence and must be confirmed directly from the advisory PDF; the affected boundary is versions 2.9.8-5620 and prior. As an immediate compensating control, disable SSH access on any PowerLogic T300 device where remote console access is not operationally required - this eliminates the AT:P prerequisite entirely and removes the attack vector. Where SSH must remain enabled, restrict SSH access via firewall ACLs or network segmentation to a whitelist of known management hosts only, enforce multi-factor or certificate-based authentication where the firmware supports it, audit all high-privilege accounts for necessity, and rotate credentials. Note that disabling SSH may impact remote firmware management workflows.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PowerLogic T300 (CPE: cpe:2.3:a:schneider_electric:powerlogic_t300:*:*:*:*:*:*:*:*) is a Schneider Electric industrial power monitoring and metering device deployed in energy management and OT environments. The root cause is CWE-78 (OS Command Injection): user-supplied input passed to the OS console handler is not stripped or escaped of shell metacharacters (semicolons, pipes, backticks, etc.), allowing the input to be interpreted as OS-level commands rather than constrained application input. The CVSS 4.0 vector AV:L/AT:P specifies that exploitation requires local or SSH-accessible network reach with SSH explicitly enabled on the target device, while PR:H confirms a high-privilege authenticated session is a prerequisite. The scope change reflected in SC:H/SI:H/SA:H captures the fact that root escalation on an ICS metering device can ripple into broader energy infrastructure visibility and control.
Know when Powerlogic T300 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Local SSH access required with high-privilege authentication; root escalation changes scope, justifying S:C with full C/I/A impact.
Primary rating from Vendor (schneider).
CVSS VectorVendor: schneider
DescriptionCVE.org
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause privilege escalation to root and unauthorized execution of administrative functions when an authenticated user with SSH enabled interacts with the operating system console that improperly processes user-controlled input.
Executive ViewAI
Schneider Electric PowerLogic T300 energy meters (versions 2.9.8-5620 and earlier) face a privilege escalation risk where high-privileged SSH users can escalate to root and execute arbitrary commands with full system access. For organizations deploying these devices for billing, monitoring, and grid operations, full system compromise poses significant operational continuity and compliance risks. The absence of a vendor patch necessitates immediate access control hardening to prevent exploitation by insiders or compromised administrative accounts.
No vendor-released patch identified at time of analysis. Interim mitigations include: restrict SSH access to PowerLogic T300 devices to essential administrative users only; enforce key-based SSH authentication instead of password authentication; implement network segmentation and firewall rules to restrict SSH connectivity to dedicated administrative workstations; enable comprehensive SSH audit logging with real-time alerting for authentication failures and anomalous command execution; disable SSH services if device operation does not require remote administrative access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
OS command injection occurs when an application passes unsanitized user input directly into system shell commands.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Exploit-DB