[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2crT5FrA7mbJtED26WLXELuvB6MhiTzDUoLDKdDZYho":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":52},"bae25148-67f2-4f21-885b-107522a7332a","hard-coded-credentials-expose-schneider-electric-protection-relays-to-unauthorized-access","fb800855-a556-4b23-970c-8c1bbb764cb1","Hard-Coded Credentials Expose Schneider Electric Protection Relays to Unauthorized Access","The Schneider Electric Easergy MiCOM Px40 Series vulnerability highlights a critical failure in secure-by-design principles: hard-coded credentials embedded in operational technology (OT) firmware give attackers a permanent, unchangeable foothold that no password policy can fix. Because these relays operate over SNMP — a protocol known for weak authentication — unauthenticated attackers on the same network can silently enumerate device information without triggering obvious alarms. This matters because protection relays are safety-critical components in electrical infrastructure; even reconnaissance-level access can inform more destructive follow-on attacks. The widespread version range affected suggests the flaw was baked in during development and propagated across an entire product family, amplifying the blast radius significantly.","**Immediate actions:**\n- Isolate all affected Easergy MiCOM Px40 Series relays behind dedicated OT network segments or firewalls to block unsolicited SNMP traffic.\n- Apply the vendor-supplied firmware upgrade that disables SNMP or upgrades to authenticated SNMP v3 as soon as operationally feasible.\n- Conduct an emergency audit of all SNMP-enabled OT and ICS devices to identify any others using default or hard-coded community strings.\n\n**Long-term improvements:**\n- Enforce a secure product development lifecycle (SDLC) requirement that prohibits hard-coded credentials in any firmware or embedded software.\n- Maintain a continuously updated OT\u002FICS asset inventory with firmware versions to accelerate future vulnerability scoping and patching.\n- Require VPN or encrypted out-of-band channels for all remote access to operational technology assets.\n\n**Detection measures:**\n- Deploy OT-aware network monitoring (e.g., Claroty, Dragos, or Nozomi) to alert on anomalous SNMP polling or unexpected device enumeration activity.\n- Establish baseline traffic profiles for protection relays and trigger alerts when SNMP queries originate from unauthorized source IPs.\n- Integrate ICS vulnerability feeds into your SIEM so newly disclosed CVEs against deployed OT assets generate automatic triage tickets.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 12: Network Infrastructure Management","CIS Control 18: Penetration Testing","NIST SP 800-82 Rev 3: Guide to OT Security","NIST IR-8: Incident Response","NIST AC-2: Account Management","NIST IA-5: Authenticator Management (prohibiting hard-coded credentials)","NIST SI-2: Flaw Remediation","IEC 62443-3-3 SR 1.5: Authenticator Management for Industrial Automation","NERC CIP-007-6: Systems Security Management (ports and services)","NERC CIP-010-4: Configuration Change Management and Vulnerability Management","GDPR Article 32: Security of Processing (where device data involves personal information)",{},"published","2026-07-09T18:22:38.525275+00:00","2026-07-09T18:22:38.408+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Fics-advisories\u002Ficsa-26-190-03","schneider-electric-easergy-micom-px40-series-4d87a8","Schneider Electric Easergy MiCOM Px40 Series",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"f43a7f30-5046-4b10-9dba-1a704139821e","Network Segmentation","network-segmentation","Lateral movement, flat networks, missing firewalls","#06b6d4",[],[53,57,60],{"slug":54,"name":55,"problem":56},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":48,"name":58,"problem":59},"Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",{"slug":61,"name":62,"problem":63},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection."]