Easergy MiCOM C264: Insufficient Entropy
CVE-2026-4827 is a high-severity insufficient entropy vulnerability in Easergy MiCOM C264 from Schneider Electric, with a CVSS 4.0 base score of 8.7 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. Affected Easergy MiCOM C264 versions: Versions D6.x; Versions D7.33 and prior. The record does not name a fixed version, so check the vendor advisory. There is no confirmed exploitation so far. EPSS estimates a 0.31% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Check which version of Easergy MiCOM C264 you run against the affected versions below, and install the vendor's latest release.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Schneider Electric | Easergy MiCOM C264 | Versions D6.x; Versions D7.33 and prior | Not stated |
| Schneider Electric | Easergy C5 | Version 1.1.17 and prior | Not stated |
| Schneider Electric | Easergy MiCOM P30 | P139 version prior to P139.678.700; P437 version prior to P437.678.700; P439 version prior to P439.678.700; P532 version prior to P532.678.700; P539 version prior to P539.678.700; P631 version prior to P631.678.700; P632 version prior to P632.678.700; P633 version prior to P633.678.700; and 8 more ranges | Not stated |
| Schneider Electric | Easergy MiCOM P40 | Not specified in the record | Not stated |
| Schneider Electric | EcoStruxure™ Power Automation System Gateway (EPAS-GTW) | Version 6.4.616.200.100 and prior | Not stated |
| Schneider Electric | EcoStruxure™ Power Automation System User Interface (EPAS-UI) | Version 3.0.3 and prior | Not stated |
| Schneider Electric | EcoStruxure™ Power Operation | Version 2022 CU6 and prior; Version 2024 CU2 and prior | Not stated |
| Schneider Electric | iPMFLS | Version 64.2025.0.13 and prior | Not stated |
| Schneider Electric | PowerLogic™ P5 Protection Relay | V02.502.103 and prior | Not stated |
| Schneider Electric | PowerLogic™ P7 Protection and Control Platform | V02.002.002 and prior | Not stated |
| Schneider Electric | PowerLogic™ T300 | Version 2.9.4 and prior | Not stated |
| Schneider Electric | PowerLogic™ T500 | Version 11.08.02 and prior | Not stated |
| Schneider Electric | Saitel DP | Version 11.06.36 and prior | Not stated |
| Schneider Electric | EasyLogic T150 (formerly Saitel DR) | Version 11.06.30 and prior | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- NoneThe attack does not depend on a particular deployment or configuration.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- PassiveA user only needs to do something routine, such as viewing a page.
- Confidentiality (vulnerable system)
- HighSerious loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- LowLimited loss of availability on the vulnerable system.
- Confidentiality (other systems)
- NoneNo loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- NoneNo loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- NoneNo loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. Scored by CNA (se.com).
Official description
CWE‑331: Insufficient Entropy vulnerability exists that could lead to unauthorized access when an attacker on the network can exploit weaknesses in session‑management protections.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
How developers prevent this class of flaw
- Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Other references
Recent Insufficient Entropy vulnerabilities
- 7.5 High severity
- 8.8 High severity
- 9.8 Critical severity
- 8.8 High severity
- 7.5 High severity
- 8.8 High severity
Spotted an error? Tell us.