Changeflow GovPing Data Privacy & Cybersecurity Multiple Schneider Electric Vulnerabilities, Da...
Priority review Notice Added Final

Multiple Schneider Electric Vulnerabilities, Data Integrity and Confidentiality Risk

Favicon for www.cert.ssi.gouv.fr CERT-FR Security Advisories
Published
Detected
Email

Summary

CERT-FR published advisory CERTFR-2026-AVI-0433 disclosing multiple vulnerabilities in Schneider Electric industrial control products. Affected products include Easergy MiCOM protection relays (multiple models), EcoStruxure Control Expert, Connexium Managed Switches, and Modicon Redundancy Switches. The vulnerabilities enable remote denial of service, data confidentiality breaches, data integrity compromise, and security policy bypass. Organizations should refer to vendor security bulletins for patches.

View original document View source feed page

What changed

CERT-FR released security advisory CERTFR-2026-AVI-0433 disclosing multiple vulnerabilities across Schneider Electric industrial control products. The vulnerabilities affect Easergy MiCOM protection relay series, EcoStruxure Control Expert, Connexium Managed Switches, and Modicon Managed/Redundancy Switches across numerous versions. Four CVEs are referenced: CVE-2024-3596, CVE-2024-8933, CVE-2024-8935, and CVE-2026-4832. The risks include remote denial of service, data confidentiality compromise, data integrity compromise, and security policy bypass.

Organizations operating affected Schneider Electric industrial control systems should immediately review the vendor security bulletins and apply available patches. These vulnerabilities could allow remote attackers to compromise industrial operations, affecting data integrity and system availability. Priority should be given to patching Connexium and Modicon Managed Switches (all versions) affected by CVE-2024-3596.

What to do next

  1. Identify whether your organization uses affected Schneider Electric products
  2. Consult vendor security bulletins (SEVD-2024-317-02, SEVD-2026-104-02, SEVD-2026-104-03) for patch information
  3. Apply available security updates from Schneider Electric

Archived snapshot

Apr 14, 2026

GovPing captured this document from the original source. If the source has since changed or been removed, this is the text as it existed at that time.

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 14 avril 2026 N° CERTFR-2026-AVI-0433 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans les produits Schneider Electric

Gestion du document

| Référence | CERTFR-2026-AVI-0433 |
| Titre | Multiples vulnérabilités dans les produits Schneider Electric |
| Date de la première version | 14 avril 2026 |
| Date de la dernière version | 14 avril 2026 |
| Source(s) | Bulletin de sécurité Schneider Electric SEVD-2024-317-02 du 12 novembre 2024
Bulletin de sécurité Schneider Electric SEVD-2026-104-02 du 14 avril 2026
Bulletin de sécurité Schneider Electric SEVD-2026-104-03 du 14 avril 2026 |
Une gestion de version détaillée se trouve à la fin de ce document.

Risques

  • Atteinte à l'intégrité des données
  • Atteinte à la confidentialité des données
  • Contournement de la politique de sécurité
  • Déni de service à distance

Systèmes affectés

  • Connexium Managed Switches toutes versions pour la vulnérabilité CVE-2024-3596
  • Easergy MiCOM P14x versions antérieures à B4A
  • Easergy MiCOM P24x versions antérieures à D3A
  • Easergy MiCOM P341 versions antérieures à E3F
  • Easergy MiCOM P342, P343, P344, P345 versions antérieures à B3F
  • Easergy MiCOM P442, P444 versions antérieures à E3A
  • Easergy MiCOM P443, P445, P446, P543, P544, P545 et P546 versions antérieures à H6A
  • Easergy MiCOM P642, P645 versions antérieures à B4A
  • Easergy MiCOM P643 versions antérieures à B3F
  • Easergy MiCOM P741, P742 et P743 versions antérieures à B2A pour la vulnérabilité CVE-2026-4832
  • Easergy MiCOM P746 versions antérieures à B4E
  • Easergy MiCOM P746 versions antérieures à C4E
  • Easergy MiCOM P841 versions antérieures à G6A
  • Easergy MiCOM P849 versions antérieures à B4A
  • EcoStruxure Control Expert versions antérieures à 16.2HF003
  • Modicon Managed Switches toutes versions pour la vulnérabilité CVE-2024-3596
  • Modicon Redundancy Switches toutes versions pour la vulnérabilité CVE-2024-3596

Résumé

De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Documentation

Gestion détaillée du document

  1. le 14 avril 2026 Version initiale

Related changes

Favicon for www.cert.ssi.gouv.fr Multiple Microsoft Office Vulnerabilities Allow Remote Code Execution, Data Breach
Priority review Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Windows Vulnerabilities Enable Code Execution, Privilege Escalation
Urgent Apr 15, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity
Favicon for www.cert.ssi.gouv.fr Multiple Vulnerabilities in Synology SSL VPN Client Prior to 1.4.5-0684
Priority review Apr 14, 2026 • CERT-FR Security Advisories • Data Privacy & Cybersecurity

Get daily alerts for CERT-FR Security Advisories

Daily digest delivered to your inbox.

Free. Unsubscribe anytime.

Source

Favicon for www.cert.ssi.gouv.fr
CERT-FR Security Advisories cert.ssi.gouv.fr/avis
Data Privacy & Cybersecurity

About this page

What is GovPing?

Every important government, regulator, and court update from around the world. One place. Real-time. Free. Our mission

What's from the agency?

Source document text, dates, docket IDs, and authority are extracted directly from CERT-FR.

What's AI-generated?

The summary, classification, recommended actions, deadlines, and penalty information are AI-generated from the original text and may contain errors. Always verify against the source document.

Last updated

Press inquiries →

Classification

Agency
CERT-FR
Published
April 14th, 2026
Instrument
Notice
Legal weight
Non-binding
Stage
Final
Change scope
Substantive
Document ID
CERTFR-2026-AVI-0433

Who this affects

Applies to
Manufacturers Energy companies Technology companies
Industry sector
3341 Computer & Electronics Manufacturing 5112 Software & Technology
Activity scope
ICS vulnerability remediation Industrial control systems security OT infrastructure patching
Geographic scope
France FR

Taxonomy

Primary area
Cybersecurity
Operational domain
IT Security
Compliance frameworks
NIST CSF
Topics
Data Privacy Critical Infrastructure

Browse Categories

Agriculture & Food Safety 65 AI Regulation 3 Banking & Finance 297 Consumer Protection 46 Courts & Legal 361 Data Privacy & Cybersecurity 76 Defense & National Security 51 Education 22 Energy 100 Environment 86 Environmental & Energy 11 Environmental Regulation 7 Financial Regulation 2 Government & Legislation 279 Government Operations 5 Healthcare 136 Healthcare & Life Sciences 5 Housing 16 Immigration 8 Immigration & Border Control 1 Insurance 58 Labor & Employment 114 Legal & Judicial 9 Pharma & Drug Safety 104 Public Health 2 Real Estate & Housing 3 Sanctions & Export Controls 1 Securities & Investments 1 Securities & Markets 103 Securities Regulation 6 Tax 65 Tax & Revenue 1 Telecom & Technology 47 Trade & Commerce 2 Trade & Sanctions 135 Transportation 60

Get alerts for this source

We'll email you when CERT-FR Security Advisories publishes new changes.

Free. Unsubscribe anytime.

You're subscribed!