# Schneider Electric Power Protection Relays Leak Device Identity via Hard-Coded SNMP Credentials
## The Threat
Schneider Electric has disclosed a vulnerability affecting its Easergy MiCOM Px40 Series protection relays—a critical component deployed across electrical utilities worldwide for protecting medium, high, and extra-high voltage distribution systems. The flaw stems from the use of hard-coded credentials in the Simple Network Management Protocol (SNMP) implementation, allowing unauthenticated attackers on the network to enumerate and identify affected devices.
Protection relays like the MiCOM Px40 series are fundamental to grid stability. These devices monitor voltage, frequency, and current across distribution networks and trigger automatic isolation of faulted sections—preventing cascading outages and protecting equipment. They sit at the intersection of operational technology and network infrastructure, making security in these devices a shared concern between utilities and their suppliers.
The vulnerability itself is classified as information disclosure rather than remote code execution or system takeover. However, the ability to remotely identify and fingerprint protection relays on a power grid network is strategically valuable reconnaissance. An attacker who can map the topology and firmware versions of a utility's relay infrastructure gains tactical knowledge useful for planning more sophisticated attacks against grid automation systems. This is particularly concerning given the increasing interconnection of industrial control systems with corporate networks and, in some cases, the internet.
## Severity and Impact
| Attribute | Details |
|---|---|
| CVE ID | CVE-2026-4832 |
| CWE Classification | CWE-798: Use of Hard-coded Credentials |
| CVSS v3.1 Base Score | 5.3 (Medium) |
| CVSS Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Impact (Confidentiality) | Low |
| Impact (Integrity) | None |
| Impact (Availability) | None |
The CVSS 5.3 rating reflects the limited scope of the direct impact—only basic device identification is exposed. However, this understates the operational security implications for critical infrastructure. An attacker with network access to SNMP ports can perform reconnaissance on grid infrastructure without authentication, which is the first phase of a multi-stage attack chain.
## Affected Products
Schneider Electric Easergy MiCOM Px40 Series protection relays are affected across multiple model lines and firmware versions:
Schneider Electric reports worldwide deployment across critical infrastructure sectors including energy generation and distribution, critical manufacturing facilities, and transportation systems.
## Mitigations
Schneider Electric has provided two remediation paths depending on operational requirements:
For facilities that do NOT require SNMP:
Contact Schneider Electric's Customer Care Center to upgrade to a firmware version that excludes SNMP functionality entirely. This is the strongest remediation option, as it eliminates the attack surface altogether.
For facilities that require SNMP for operational monitoring:
Apply the following mitigations immediately:
Firmware upgrades addressing this vulnerability should be prioritized and deployed during the next scheduled maintenance window. Utilities should coordinate firmware rollouts with operations teams to minimize service impact.
## References
---
## HackWire Analysis
The hard-coded credential pattern in industrial protection relays is not new, but it persists because of the unique constraints of critical infrastructure: long asset lifecycles, difficulty deploying patches without service interruption, and the traditional air-gapped isolation model that made network security less pressing.
What's changed is the attack surface. Modern electrical grids are increasingly interconnected for remote monitoring and automation. Relays that were once isolated within utility substations are now addressable from corporate networks, regional control centers, and in some cases, cloud-based SCADA platforms. A hard-coded credential that would have been unreachable ten years ago is now scannable from a compromised workstation in a utility's operations center—or potentially from outside if a network boundary has been misconfigured.
The CVSS 5.3 rating deserves scrutiny here. The metric captures that this is information disclosure with no direct control impact. But reconnaissance of grid infrastructure has first-order value to nation-state and sophisticated non-state attackers conducting long-term grid security research. The U.S. has observed persistent scanning of electrical grid networks for years, probing SCADA systems, control relays, and management consoles. Adding the ability to identify MiCOM relay models and firmware versions without authentication shortens the time an attacker needs to spend on reconnaissance before launching a more damaging attack.
For utilities, the practical issue is prioritization. Patch management for thousands of distributed relay endpoints is operationally complex. The lack of a remote code execution flaw may cause this vulnerability to slip down the priority list, especially for smaller utilities with limited security budgets. That's precisely the wrong call—network reconnaissance capabilities should be treated as precursors to more damaging attacks and remediated within 30 days, not months.
The broader pattern: every month brings another reminder that industrial control systems were not designed with modern threat models in mind. Hard-coded credentials are a symptom of a deeper problem: the expectation that physical security and network isolation would be the primary control. As that model breaks down, every implicit trust—default passwords, unauthenticated services, trust-on-first-use protocols—becomes an attack surface.
— HackWire Editorial
## Related Coverage