As reported by CISA in advisory ICSA-26-190-03, Schneider Electric has disclosed a vulnerability affecting its widely deployed Easergy MiCOM Px40 Series protection relays — devices that sit at the heart of medium, high, and extra-high voltage electrical distribution and grid automation systems globally.
Vulnerability at a Glance
- Advisory ID
- ICSA-26-190-03
- Vendor
- Schneider Electric
- Affected Product Family
- Easergy MiCOM Px40 Series (protection relays for MV/HV/EHV applications)
- Vulnerability Type
- Unauthorized exposure of device identification data via SNMP
- CVE Identifier
- Not publicly enumerated in summary; refer to full CSAF document at CISA advisory page
- CVSS Severity
- Not specified in summary; review CSAF for scoring
- Patch Available
- Yes — updated firmware versions per model (see below)
- Active Exploitation Observed
- Not reported at time of advisory
Affected Versions
Why This Matters Beyond the Advisory
At first glance, an SNMP-based device identification disclosure might seem like a low-severity finding — the kind of issue easily dismissed as "limited impact" in a traditional IT context. That framing is dangerously wrong when applied to operational technology (OT) environments managing electrical grid infrastructure.
Protection relays in the MiCOM Px40 family perform critical safety functions: they detect fault conditions on power lines and initiate automated tripping to isolate faults and protect grid assets. These are not passive monitoring devices — they are active control elements in substations. Any intelligence an adversary can gather about their configuration, firmware version, or identity is valuable for staging more sophisticated follow-on attacks.
Device fingerprinting via SNMP is frequently the first step in targeted ICS attack chains. Adversaries use enumerated device metadata to identify unpatched systems, match known exploit capabilities, and prioritize lateral movement within OT networks.
The breadth of the affected product range is also notable. With over a dozen distinct relay models spanning multiple voltage classes — from medium voltage distribution to extra-high voltage transmission — the attack surface is substantial. Utilities and grid operators in regions with aging substation automation infrastructure are particularly at risk if firmware upgrade cycles have been deferred.
Who Is Most at Risk
- Electric utilities and grid operators running legacy substation automation with unpatched MiCOM relays
- Industrial facilities with private MV distribution networks (manufacturing, data centers, hospitals)
- Critical national infrastructure operators in regions where SNMP-enabled OT devices are exposed on flat or poorly segmented networks
- Organizations where firmware upgrades require planned outages and have historically been deferred
Shield53 Recommendations
Immediate Actions
- Inventory all MiCOM Px40 devices across your OT environments — including remote substations — and map current firmware versions against the patched baselines listed above.
- Prioritize firmware upgrades using Schneider Electric's official update process. Consult the CISA CSAF document and Schneider's product advisory portal for verified upgrade packages.
- Disable or restrict SNMP access on all affected relays immediately if patching cannot be scheduled imminently. Where SNMP must remain active, enforce SNMPv3 with authentication and encryption, and restrict community strings.
- Implement network-level ACLs to ensure SNMP traffic to/from protection relays is permitted only from authorized management hosts. SNMP should never be reachable from untrusted network segments or the internet.
- Enable logging and alerting on SNMP queries to protection relay IP ranges. Unexpected polling sources may indicate reconnaissance activity.
- Review substation network segmentation: engineering workstations, SCADA/EMS systems, and protection relays should reside in isolated zones with strict inter-zone communication controls.
Longer-Term Posture
This advisory is a timely reminder that OT asset lifecycle management — including firmware currency — must be treated as a first-class security program requirement, not an afterthought. Organizations should establish a formal OT patch management process with defined SLAs for critical infrastructure advisories, and ensure that planned maintenance windows accommodate security-driven firmware updates, not just operational needs.
Grid security teams should also consider deploying passive OT network monitoring solutions capable of detecting anomalous SNMP activity and device fingerprinting behavior, which can serve as an early warning system for adversary reconnaissance even before active exploitation begins.
