CVE-2026-4827— Insufficient Entropy vulnerability on Multiple Products
Affected Version Matrix 31
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Schneider Electric | Easergy C5 | Version 1.1.17 and prior | affected |
| Schneider Electric | Easergy MiCOM C264 | Versions D6.x | affected |
Versions D7.33 and prior | affected | ||
| Schneider Electric | Easergy MiCOM P30 | P139 version prior to P139.678.700 | affected |
P437 version prior to P437.678.700 | affected | ||
P439 version prior to P439.678.700 | affected | ||
P532 version prior to P532.678.700 | affected | ||
P539 version prior to P539.678.700 | affected | ||
P631 version prior to P631.678.700 | affected | ||
P632 version prior to P632.678.700 | affected | ||
P633 version prior to P633.678.700 | affected | ||
| … +8 more rows | |||
| Schneider Electric | Easergy MiCOM P40 | Series model numbers with Protocol Option bit as G, H or L and all firmware versions | affected |
| Schneider Electric | EasyLogic T150 (formerly Saitel DR) | Version 11.06.30 and prior | affected |
| Schneider Electric | EcoStruxure™ Power Automation System Gateway (EPAS-GTW) | Version 6.4.616.200.100 and prior | affected |
| Schneider Electric | EcoStruxure™ Power Automation System User Interface (EPAS-UI) | Version 3.0.3 and prior | affected |
| Schneider Electric | EcoStruxure™ Power Operation | Version 2022 CU6 and prior | affected |
Version 2024 CU2 and prior | affected | ||
| Schneider Electric | iPMFLS | Version 64.2025.0.13 and prior | affected |
| Schneider Electric | PowerLogic™ P5 Protection Relay | V02.502.103 and prior | affected |
| Schneider Electric | PowerLogic™ P7 Protection and Control Platform | V02.002.002 and prior | affected |
| Schneider Electric | PowerLogic™ T300 | Version 2.9.4 and prior | affected |
| Schneider Electric | PowerLogic™ T500 | Version 11.08.02 and prior | affected |
| Schneider Electric | Saitel DP | Version 11.06.36 and prior | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-4827
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Insufficient Entropy vulnerability on Multiple Products
Source: NVD (National Vulnerability Database)
Vulnerability Description
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
信息熵不充分
Source: NVD (National Vulnerability Database)
Vulnerability Title
Schneider Electric多款产品 安全特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Schneider Electric Easergy MiCOM Px40 Series等都是法国施耐德电气（Schneider Electric）公司的产品。Schneider Electric Easergy MiCOM Px40 Series是一系列电力保护与控制继电器设备。Schneider Electric Easergy MiCOM C264是一款面向电力系统变电站与配电网络的工业通信网关与远程终端设备。Schneider Electric Easergy MiCOM P30是一系列面向电力系
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-4827
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-4827
请登录查看更多情报信息。
Same Patch Batch · Schneider Electric · 2026-05-12 · 3 CVEs total
| CVE-2026-6865 | Improper Limitation of a Pathname to a Restricted Directory Vulnerability on Multiple Prod | |
| CVE-2026-6866 | Initialization of a Resource with an Insecure Default vulnerability on EcoStruxure™ Panel |
IV. Related Vulnerabilities
Same vendor: Schneider Electric
- CVE-2026-6332
Clear Text Storage of Sensitive Information on EcoStruxure™ - CVE-2026-6866
Initialization of a Resource with an Insecure Default vulner - CVE-2026-6865
Improper Limitation of a Pathname to a Restricted Directory - CVE-2026-2401
Schneider Electric PowerChute Serial Shutdown 日志信息泄露漏洞 - CVE-2026-2400
Schneider Electric PowerChute Serial Shutdown 注入漏洞
Same weakness: CWE-331
- CVE-2026-8700
Crypt::DSA versions before 1.20 for Perl generate seeds usin - CVE-2026-46474
Trog::TOTP versions before 1.006 for Perl generate secrets u - CVE-2025-14972
Insufficient DPA countermeasure reseeding - CVE-2026-7210
The expat and elementtree parsers use insufficient entropy f - CVE-2026-2336
Weak webstax_auth Cookie Authentication Allows Privilege Esc
V. Comments for CVE-2026-4827
No comments yet