Summary
Schneider Electric is aware of a vulnerability in its PowerLogic P5 products.
The PowerLogic P5 is a medium voltage protection relay.
Failure to apply the mitigations provided below may risk denial of service, device reboot, or an
attacker gaining full control of the relay. This could result in loss of protection to your electrical
network. Physical access to the device is required to exploit this issue
Vulnerabilities 1
-
Medium 6.1
CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, devi…
Revision history
-
#1.2.0
Remediation for the PowerLogic P5 is now available
-
#1.0.0
Original Release
-
#1.1.0
PowerLogic P5 patch was retracted, and customers should deploy the mitigations provided below. Also, there was an update to the affected product version.
References
-
PowerLogic P5 - SEVD-2024-163-02 PDF Version
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=sevd-2024-163-02.pdf
-
Recommended Cybersecurity Best Practices
https://www.se.com/us/en/download/document/7EN52-0390
-
ICS Advisory ICSA-24-331-02 - Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-24-331-02
-
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
-
Recommended Practices
https://www.cisa.gov/resources-tools/resources/ics-recommended-practices
-
Recommended Practices
https://www.cisa.gov/topics/industrial-control-systems
-
Recommended Practices
https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.cisa.gov/sites/default/files/publications/Cybersecurity_Best_Practices_for_Industrial_Control_Systems.pdf
-
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B