Schneider Electric EasyLogic T150 entropy

Summaryinfo

A vulnerability classified as problematic was found in Schneider Electric Easergy MiCOM C264, Easergy C5, Easergy MiCOM P30, Easergy MiCOM P40, EcoStruxure Power Automation System Gateway, EcoStruxure Power Automation System User Interface, EcoStruxure Power Operation, iPMFLS, PowerLogic P5 Protection Relay, PowerLogic P7 Protection and Control Platform, PowerLogic T300, PowerLogic T500, Saitel DP and EasyLogic T150. This impacts an unknown function. Such manipulation leads to entropy. This vulnerability is referenced as CVE-2026-4827. It is possible to launch the attack remotely. No exploit is available. It is advisable to implement a patch to correct this issue.

Detailsinfo

A vulnerability was found in Schneider Electric Easergy MiCOM C264, Easergy C5, Easergy MiCOM P30, Easergy MiCOM P40, EcoStruxure Power Automation System Gateway, EcoStruxure Power Automation System User Interface, EcoStruxure Power Operation, iPMFLS, PowerLogic P5 Protection Relay, PowerLogic P7 Protection and Control Platform, PowerLogic T300, PowerLogic T500, Saitel DP and EasyLogic T150 and classified as problematic. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a entropy vulnerability. Using CWE to declare the problem leads to CWE-331. The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others. Impacted is confidentiality. CVE summarizes:

CWE‑331 Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

The advisory is shared for download at download.schneider-electric.com. This vulnerability is handled as CVE-2026-4827 since 03/25/2026. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

Applying a patch is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-29459). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• SCADA Software

Vendor

• Schneider Electric

Name

• Easergy C5
• Easergy MiCOM C264
• Easergy MiCOM P30
• Easergy MiCOM P40
• EasyLogic T150
• EcoStruxure Power Automation System Gateway
• EcoStruxure Power Automation System User Interface
• EcoStruxure Power Operation
• iPMFLS
• PowerLogic P5 Protection Relay
• PowerLogic P7 Protection and Control Platform
• PowerLogic T300
• PowerLogic T500
• Saitel DP

License

• commercial

Website

• Vendor: https://www.schneider-electric.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion