Reachable Assertion DoS in Network-Exposed Service

Compliance Impact

The vulnerability in Schneider Electric's PowerLogic™ P7 product allows an authenticated attacker to cause a denial-of-service condition, impacting system availability. Since availability is a key component of many compliance standards such as GDPR and HIPAA, this vulnerability could potentially affect compliance by disrupting critical services and availability requirements.

Mitigation steps such as applying firmware updates or restricting network access are recommended to maintain system availability and help ensure compliance with these standards.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-9718 is a medium-severity vulnerability classified as CWE-617 (Reachable Assertion) that affects Schneider Electric's PowerLogic™ P7 product versions V02.003.001.000 and earlier.

This vulnerability allows an authenticated attacker to send a specially crafted request to a network-exposed service, which triggers a denial-of-service condition by causing a reachable assertion failure.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to a denial-of-service condition, resulting in loss of system availability.

This impact could disrupt critical services that rely on the affected PowerLogic™ P7 product, potentially causing operational interruptions.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability affects Schneider Electric's PowerLogic™ P7 product versions V02.003.001.000 and prior, specifically on the network-exposed service running on TCP/IP port 8080.

Detection can involve checking for the presence of the vulnerable service on port 8080 and verifying the firmware version of the PowerLogic™ P7 device.

• Use network scanning tools like nmap to detect if port 8080 is open on your devices: nmap -p 8080 <target-ip>
• Check the firmware version of the PowerLogic™ P7 device via its administrative interface or command line to confirm if it is V02.003.001.000 or earlier.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the vulnerability, apply the latest firmware update (Version V02.004.001.000) provided by Schneider Electric.

Alternatively, restrict network access to the PowerLogic™ P7 service endpoints by limiting access to TCP/IP port 8080.

Limit administrative access to trusted users to reduce the risk of an authenticated attacker exploiting the vulnerability.

Useful 0 Not Useful 0