Insufficient Entropy vulnerability on Multiple Products (Schneider Electric Easergy MiCOM C264)

CVE-2026-4827

HIGH 8.7

At a glance

Source: NVD
EPSS: EPSS 0.31 % · percentile 24 (2026-11-01)
State: PUBLISHED
Published: 2026-05-12 12:24 UTC
Updated: 2026-05-14 17:38 UTC
Assigner: schneider
NVD status: Awaiting Analysis

Search on…

Description

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

Weaknesses (CWE)

CWE-331 — Insufficient Entropy

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-132-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-132-02.pdf

Scores

Version	Score	Vector	Scored by
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N	schneider
CVSS 4.0	HIGH 8.7	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X	NVD · cybersecurity@se.com (Secondary)

European references

ENISA EUVD · EUVD-2026-29459
GCVE · GCVE-0-2026-4827

CERT-FR advisories

CERTFR-2026-AVI-0566 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr

Affected products

Product	Versions
Schneider Electric · Easergy MiCOM C264	affected Versions D6.x ; affected Versions D7.33 and prior
Schneider Electric · Easergy C5	affected Version 1.1.17 and prior
Schneider Electric · Easergy MiCOM P30	affected P139 version prior to P139.678.700 ; affected P437 version prior to P437.678.700 ; affected P439 version prior to P439.678.700 ; affected P532 version prior to P532.678.700 ; affected P539 version prior to P539.678.700 ; affected P631 version prior to P631.678.700
Schneider Electric · Easergy MiCOM P40	affected Series model numbers with Protocol Option bit as G, H or L and all firmware versions
Schneider Electric · EcoStruxure™ Power Automation System Gateway (EPAS-GTW)	affected Version 6.4.616.200.100 and prior
Schneider Electric · EcoStruxure™ Power Automation System User Interface (EPAS-UI)	affected Version 3.0.3 and prior
Schneider Electric · EcoStruxure™ Power Operation	affected Version 2022 CU6 and prior ; affected Version 2024 CU2 and prior
Schneider Electric · iPMFLS	affected Version 64.2025.0.13 and prior
Schneider Electric · PowerLogic™ P5 Protection Relay	affected V02.502.103 and prior
Schneider Electric · PowerLogic™ P7 Protection and Control Platform	affected V02.002.002 and prior
Schneider Electric · PowerLogic™ T300	affected Version 2.9.4 and prior
Schneider Electric · PowerLogic™ T500	affected Version 11.08.02 and prior
Schneider Electric · Saitel DP	affected Version 11.06.36 and prior
Schneider Electric · EasyLogic T150 (formerly Saitel DR)	affected Version 11.06.30 and prior

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD