PatchSiren

PatchSiren cyber security CVE debrief

CVE-2016-5818 Schneider Electric CVE debrief

CVE-2016-5818 is a critical authentication flaw in Schneider Electric PowerLogic PM8ECC firmware 2.651 and older. The issue is documented as undocumented hard-coded credentials that can allow access to the device, which is why it is rated 9.8/CRITICAL. Because the condition can enable unauthorized access without needing user interaction, it should be treated as an urgent asset-protection issue for any exposed or deployed PM8ECC systems.

Vendor
Schneider Electric
Product
CVE-2016-5818
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2017-02-13
Original CVE updated
2026-05-13
Advisory published
2017-02-13
Advisory updated
2026-05-13

Who should care

Industrial control system operators, OT security teams, network defenders, and asset owners running Schneider Electric PowerLogic PM8ECC firmware 2.651 or older should prioritize this advisory. It is especially important for environments where PM8ECC devices are reachable from shared networks, remote management paths, or vendor support channels.

Technical summary

NVD lists the affected product as Schneider Electric PowerLogic PM8ECC firmware 2.651 and older, with a vulnerable CPE entry for the firmware line. The weakness is mapped to CWE-798 (Use of Hard-coded Credentials). The CVSS vector is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network-reachable, low-complexity, unauthenticated impact with high confidentiality, integrity, and availability consequences. The issue is described in the source corpus as undocumented hard-coded credentials allowing access to the device.

Defensive priority

Urgent. Any confirmed deployment of the affected firmware should be treated as high priority for remediation, containment, and access review because the vulnerability allows unauthorized access and carries critical CVSS impact.

Recommended defensive actions

  • Identify all Schneider Electric PowerLogic PM8ECC devices and confirm firmware versions against 2.651 and older.
  • Restrict network reachability to affected devices, especially from user networks, remote access paths, and untrusted segments.
  • Review device access controls and management exposure for any signs of unauthorized or unexpected access.
  • Apply vendor or advisory guidance referenced by ICS-CERT advisory ICSA-16-292-01 where available.
  • Plan firmware or device replacement/upgrade for any affected systems that cannot be promptly remediated.
  • Document compensating controls and monitor for any unusual authentication or configuration activity on impacted assets.

Evidence notes

The CVE record and NVD entry identify the affected product as Schneider Electric PowerLogic PM8ECC firmware 2.651 and older. The vulnerability is described as undocumented hard-coded credentials allowing access to the device, and NVD maps it to CWE-798. The CVSS vector provided by NVD indicates network attackability with no privileges or user interaction required and high impact. Reference links in the source corpus include the CVE record, NVD detail page, and ICS-CERT advisory ICSA-16-292-01.

Official resources

Publicly disclosed in the CVE record on 2017-02-13 and referenced by NVD and ICS-CERT advisory ICSA-16-292-01. This debrief does not include exploit instructions or unsupported details.