Schneider Electric PowerLogic P7 Vulnerability Advisory: CVE-2026-9716/9717/9718 RCE/DoS

Vulnerability Overview Schneider Electric has identified multiple vulnerabilities in its PowerLogic™ P7 products. These vulnerabilities may allow unauthorized execution of privileged commands or loss of HMI operability and configuration capabilities, potentially leading to loss of system control and interruption of critical operations. Affected Products Product: PowerLogic™ P7 Version: Versions V02.003.001.000 and prior Vulnerability Details 1. CVE ID: CVE-2026-9716 - CVSS v3.1 Base Score: 7.5 - CVSS v4.0 Base Score: 8.7 - Description: A NULL Pointer Dereference vulnerability exists, which may lead to a denial-of-service condition, rendering the device's HMI and configuration features unavailable when receiving malicious requests. 2. CVE ID: CVE-2026-9717 - CVSS v3.1 Base Score: 7.2 - CVSS v4.0 Base Score: 8.6 - Description: A Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability exists, allowing unauthorized execution of commands with elevated privileges. This impacts system integrity, confidentiality, and availability when a privileged authenticated user interacts with the vulnerable network service. 3. CVE ID: CVE-2026-9718 - CVSS v3.1 Base Score: 4.9 - CVSS v4.0 Base Score: 6.9 - Description: No specific description provided. Remediation Recommendation: Apply the provided mitigation measures to avoid the aforementioned risks. Specific Steps: No specific remediation steps are provided; please refer to the official documentation or contact Schneider Electric for detailed remediation guidance. Notes Release Date: 09 June 2026 Document Reference Number: SEVU-2026-1503 --- Note: No Proof of Concept (POC) code or exploitation code is included in the page.

Goal Reached Thanks to every supporter — we hit 100%!

Schneider Electric PowerLogic P7 Vulnerability Advisory: CVE-2026-9716/9717/9718 RCE/DoS