Read the docs
TI-2026-04210 Aliases CVE-2026-4827GHSA-r6x4-qp59-vf35

Insufficient Entropy vulnerability on Multiple Products

Priority MEDIUM 45CWE-331Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00312 24th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Schneider ElectricEasergy MiCOM C264Versions D6.x; Versions D7.33 and prior—No fix listedCNA
Schneider ElectricEasergy C5up to 1.1.17—No fix listedCNA
Schneider ElectricEasergy MiCOM P30P139 version prior to P139.678.700; P437 version prior to P437.678.700; P439 version prior to P439.678.700; P532 version prior to P532.678.700; P539 version prior to P539.678.700; P631 version prior to P631.678.700; P632 version prior to P632.678.700; P633 version prior to P633.678.700; P634 version prior to P634.678.700; P633 version P633.680.700 only; P634 version P634.680.700 only; P138 version prior to P138.677.700; P436 version prior to P436.677.701; P438 version prior to P438.677.701; P638 version prior to P638.677.700; C434 version prior to C434.679.700—No fix listedCNA
Schneider ElectricEasergy MiCOM P40Series model numbers with Protocol Option bit as G, H or L and all firmware versions—No fix listedCNA
Schneider ElectricEcoStruxure™ Power Automation System Gateway (EPAS-GTW)up to 6.4.616.200.100—No fix listedCNA
Schneider ElectricEcoStruxure™ Power Automation System User Interface (EPAS-UI)up to 3.0.3—No fix listedCNA
Schneider ElectricEcoStruxure™ Power OperationVersion 2022 CU6 and prior; Version 2024 CU2 and prior—No fix listedCNA
Schneider ElectriciPMFLSup to 64.2025.0.13—No fix listedCNA
Schneider ElectricPowerLogic™ P5 Protection Relayup to V02.502.103—No fix listedCNA
Schneider ElectricPowerLogic™ P7 Protection and Control Platformup to V02.002.002—No fix listedCNA
Schneider ElectricPowerLogic™ T300up to 2.9.4—No fix listedCNA
Schneider ElectricPowerLogic™ T500up to 11.08.02—No fix listedCNA
Schneider ElectricSaitel DPup to 11.06.36—No fix listedCNA
Schneider ElectricEasyLogic T150 (formerly Saitel DR)up to 11.06.30—No fix listedCNA
  • Easergy MiCOM C264 VendorSchneider Electric Affected Versions D6.x; Versions D7.33 and prior Fixed in — No fix listed CNA
  • Easergy C5 VendorSchneider Electric Affected up to 1.1.17 Fixed in — No fix listed CNA
  • Easergy MiCOM P30 VendorSchneider Electric Affected P139 version prior to P139.678.700; P437 version prior to P437.678.700; P439 version prior to P439.678.700; P532 version prior to P532.678.700; P539 version prior to P539.678.700; P631 version prior to P631.678.700; P632 version prior to P632.678.700; P633 version prior to P633.678.700; P634 version prior to P634.678.700; P633 version P633.680.700 only; P634 version P634.680.700 only; P138 version prior to P138.677.700; P436 version prior to P436.677.701; P438 version prior to P438.677.701; P638 version prior to P638.677.700; C434 version prior to C434.679.700 Fixed in — No fix listed CNA
  • Easergy MiCOM P40 VendorSchneider Electric Affected Series model numbers with Protocol Option bit as G, H or L and all firmware versions Fixed in — No fix listed CNA
  • EcoStruxure™ Power Automation System Gateway (EPAS-GTW) VendorSchneider Electric Affected up to 6.4.616.200.100 Fixed in — No fix listed CNA
  • EcoStruxure™ Power Automation System User Interface (EPAS-UI) VendorSchneider Electric Affected up to 3.0.3 Fixed in — No fix listed CNA
  • EcoStruxure™ Power Operation VendorSchneider Electric Affected Version 2022 CU6 and prior; Version 2024 CU2 and prior Fixed in — No fix listed CNA
  • iPMFLS VendorSchneider Electric Affected up to 64.2025.0.13 Fixed in — No fix listed CNA
  • PowerLogic™ P5 Protection Relay VendorSchneider Electric Affected up to V02.502.103 Fixed in — No fix listed CNA
  • PowerLogic™ P7 Protection and Control Platform VendorSchneider Electric Affected up to V02.002.002 Fixed in — No fix listed CNA
  • PowerLogic™ T300 VendorSchneider Electric Affected up to 2.9.4 Fixed in — No fix listed CNA
  • PowerLogic™ T500 VendorSchneider Electric Affected up to 11.08.02 Fixed in — No fix listed CNA
  • Saitel DP VendorSchneider Electric Affected up to 11.06.36 Fixed in — No fix listed CNA
  • EasyLogic T150 (formerly Saitel DR) VendorSchneider Electric Affected up to 11.06.30 Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-4827
  2. 2026-10-03 Alias added: GHSA-r6x4-qp59-vf35

References

Other 1

  • TI-2018-05679 SQL injection in U.motion Builder software version 1.3.4 KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-05589 Hard-coded credentials in EVlink City , EVlink Parking , and EVlink Smart Wallbox CVSS 3.1CRITICAL 9.8
  • TI-2022-15561 OS command injection in Schneider Electric SpaceLogic C-Bus Home Controller CVSS 3.1HIGH 8.8
  • TI-2023-04970 Path traversal in Schneider Electric C-Bus Toolkit CVSS 3.1CRITICAL 9.8
  • TI-2019-04862 Improper handling of exceptional conditions in Schneider Electric Modicon M580 CVSS 3.1HIGH 7.5
  • TI-2018-05690 Improper handling of exceptional conditions in Modicon M580 Modicon M340 Modicon Quantum… CVSS 3.1HIGH 7.5
See all 888 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences