Schneider Electric Easergy, EcoStruxture, PowerLogic, and Saitel Products (Update A)

Schneider Electric has released updates to address a critical session hijacking vulnerability (CWE-331) in several of its industrial automation products, including Easergy, EcoStruxture, PowerLogic, and Saitel. The vulnerability stems from insufficient entropy and could allow an attacker to gain unauthorized access to the system. Affected products include various versions of the MiCOM C264, P139, P437, P439, P532, P539, P631, P632, P633, P634, P138, C434, and several firmware versions of the DP RTU and EasyLogic T150. Users are advised to contact Schneider Electric’s Customer Care Center to obtain and install the latest firmware updates, which require a reboot to complete the process.