CVE-2016-5818 Schneider Electric CVE debrief

Who should care

Industrial control system operators, OT security teams, network defenders, and asset owners running Schneider Electric PowerLogic PM8ECC firmware 2.651 or older should prioritize this advisory. It is especially important for environments where PM8ECC devices are reachable from shared networks, remote management paths, or vendor support channels.

Technical summary

NVD lists the affected product as Schneider Electric PowerLogic PM8ECC firmware 2.651 and older, with a vulnerable CPE entry for the firmware line. The weakness is mapped to CWE-798 (Use of Hard-coded Credentials). The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity, unauthenticated impact with high confidentiality, integrity, and availability consequences. The issue is described in the source corpus as undocumented hard-coded credentials allowing access to the device.

Defensive priority

Urgent. Any confirmed deployment of the affected firmware should be treated as high priority for remediation, containment, and access review because the vulnerability allows unauthorized access and carries critical CVSS impact.

Recommended defensive actions

• Identify all Schneider Electric PowerLogic PM8ECC devices and confirm firmware versions against 2.651 and older.
• Restrict network reachability to affected devices, especially from user networks, remote access paths, and untrusted segments.
• Review device access controls and management exposure for any signs of unauthorized or unexpected access.
• Apply vendor or advisory guidance referenced by ICS-CERT advisory ICSA-16-292-01 where available.
• Plan firmware or device replacement/upgrade for any affected systems that cannot be promptly remediated.
• Document compensating controls and monitor for any unusual authentication or configuration activity on impacted assets.

Evidence notes

The CVE record and NVD entry identify the affected product as Schneider Electric PowerLogic PM8ECC firmware 2.651 and older. The vulnerability is described as undocumented hard-coded credentials allowing access to the device, and NVD maps it to CWE-798. The CVSS vector provided by NVD indicates network attackability with no privileges or user interaction required and high impact. Reference links in the source corpus include the CVE record, NVD detail page, and ICS-CERT advisory ICSA-16-292-01.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.