CISA has published ICS Advisory ICSA-26-169-07 (Update A) covering a vulnerability affecting a broad swath of Schneider Electric's power protection and substation automation portfolio: the Easergy C5 bay controller, Easergy MiCOM P30/P40 protection relays, Easergy MiCOM C264 substation controller/RTU, the EcoStruxure Power Automation System Gateway (EPAS-GTW), and related PowerLogic and Saitel product lines. These are not commodity IT assets — they are the protective relays, bay controllers, and communication gateways that sit inside medium, high, and extra-high-voltage electrical distribution networks. When a vulnerability lands in this class of equipment, the blast radius is measured in grid stability, not just data loss.
If you operate electrical distribution infrastructure — utilities, data centers, hospitals, manufacturing campuses with their own substations, or oil and gas facilities — this advisory applies to you. The affected devices are exactly the kind of equipment threat actors target when they want physical effect: pre-positioning campaigns against energy-sector OT have repeatedly demonstrated interest in protection relays and substation gateways precisely because manipulating them can trip breakers, blind operators, or degrade power quality. Treat this advisory as an operational priority, not a paperwork exercise.
Technical Analysis
Affected Products
Based on the advisory, the vulnerable products span Schneider Electric's substation automation and power management lines:
- Easergy C5 — scalable bay controller, protection, and merging unit for large/critical electrical distribution systems
- Easergy MiCOM P30 — multifunction protection and control relays for medium, high, and extra-high-voltage networks
- Easergy MiCOM P40 — protection relay series for MV/HV/EHV protection
- Easergy MiCOM C264 — modular substation/bay controller, smart RTU, and MV all-in-one solution
- EcoStruxure Power Automation System Gateway (EPAS-GTW) — ruggedized communication gateway for remote monitoring and operation of substation equipment
- PowerLogic and Saitel product families (per the advisory title; consult the CSAF document linked from the CISA advisory for the complete affected product and version list)
The full machine-readable affected-version matrix is published in Schneider Electric's CSAF (Common Security Advisory Framework) document referenced by the advisory. Pull that CSAF file and diff it against your asset inventory — this is precisely the workflow CSAF was designed for, and manual PDF-reading does not scale across a fleet of substations.
Defender's Perspective on the Attack Surface
Devices in this class share a common exposure profile:
- Protocol surface: These relays, RTUs, and gateways speak DNP3, IEC 61850 (GOOSE/MMS), IEC 60870-5-104, Modbus/TCP, and often expose embedded web management interfaces and engineering/configuration services. Any flaw in protocol parsing, authentication handling, or the web/management stack is remotely reachable from any network segment that can route to the device.
- Trust model: Substation devices historically assume a trusted network. An attacker who has pivoted from IT into the SCADA DMZ — or a compromised engineering workstation — can typically reach these devices with no further authentication barriers beyond what the device itself enforces.
- Impact chain: Exploitation of a protection relay or gateway can enable unauthorized configuration changes, denial of protective functions, manipulation of telemetry sent to the control center, or a device crash requiring a truck roll. In a coordinated scenario, this is the difference between a network incident and a physical outage.
Exploitation Status
At the time of this writing, the advisory is a coordinated vendor disclosure published through CISA; there is no confirmed public reporting of in-the-wild exploitation, and no public proof-of-concept has been identified. That said, ICS advisories against major energy-sector vendors are routinely weaponized after disclosure — asset owners should assume scanning for internet-exposed instances will begin immediately (if it hasn't already). Verify whether the affected CVEs have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog during your triage; KEV inclusion would compress your remediation window to the BOD 22-01 timelines for federal agencies and should drive equivalent urgency for private operators.
Detection & Response
Detection engineering for embedded OT devices is primarily a network-side and gateway-side discipline — you cannot install an EDR agent on a MiCOM relay. Focus on: (a) anomalous protocol talkers, (b) unauthorized engineering/configuration sessions, and (c) hardening verification on the Windows engineering workstations and gateways that administer these devices.
The Sigma rules below target the management plane: unexpected hosts initiating connections to substation protocol ports, and suspicious process execution originating from gateway/engineering hosts — the most reliable observable behaviors when an attacker begins interacting with protection relays.
---
title: Unauthorized Host Communicating with Substation Protection Relay Protocols
id: 3f8a2b71-6c4d-4e9a-b1f5-7d2e9c0a4b8d
status: experimental
description: Detects network connections to ICS protocol ports (DNP3, IEC 61850 MMS, IEC 60870-5-104, Modbus) from hosts outside the approved engineering workstation / SCADA DMZ allowlist. A protection relay or gateway receiving connections from an IT-side host is a strong indicator of pivot into the OT zone.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-07
- https://attack.mitre.org/techniques/T0867/
author: Security Arsenal
date: 2026/06/18
tags:
- attack.lateral_movement
- attack.t0867
logsource:
category: firewall
product: zeek
detection:
selection_ports:
dst_port:
- 20000 # DNP3
- 102 # IEC 61850 MMS / ISO-TSAP
- 2404 # IEC 60870-5-104
- 502 # Modbus TCP
filter_approved_talkers:
src_ip:
- '10.10.50.0/24' # replace: SCADA DMZ engineering subnet
- '10.10.60.0/24' # replace: control center HMI subnet
condition: selection_ports and not filter_approved_talkers
falsepositives:
- New engineering workstations not yet added to the allowlist
- Authorized vulnerability scanners (scope scans to maintenance windows)
level: high
---
title: Engineering or Gateway Host Spawning Unexpected Command Shell
id: 9c1d4e82-5b3a-4f7c-a2d8-1e6b0f3c7a91
status: experimental
description: Detects cmd.exe, PowerShell, or script interpreters spawned by non-standard parent processes on Windows engineering workstations and EPAS-GTW management hosts. Embedded-gateway compromise or malicious configuration tooling frequently results in shell execution under service or application processes.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-07
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/18
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_shell:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
selection_suspicious_parents:
ParentImage|endswith:
- '\java.exe'
- '\javaw.exe'
- '\tomcat.exe'
- '\nginx.exe'
- '\httpd.exe'
- '\svchost.exe'
condition: selection_shell and selection_suspicious_parents
falsepositives:
- Vendor maintenance scripts executed under service wrappers — baseline per host during commissioning
level: high
// Hunt: Inbound connections to substation protocol ports from non-OT sources.
// Requires firewall/NDR logs ingested into Sentinel (CommonSecurityLog) or Defender NDR (DeviceNetworkEvents).
// Replace the ApprovedOTSubnets list with your SCADA DMZ / engineering workstation ranges.
let ApprovedOTSubnets = dynamic(["10.10.50.0/24", "10.10.60.0/24"]);
let ICSPorts = dynamic([20000, 102, 2404, 502]);
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (ICSPorts)
| where not(ipv4_is_in_any_range(SourceIP, ApprovedOTSubnets))
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
DestinationDevices = make_set(DestinationIP, 20) by SourceIP, DestinationPort, DeviceAction
| order by ConnectionCount desc
;
// Companion hunt: new processes on engineering workstations touching relay management tools
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where DeviceName has_any ("engws", "scada", "epas", "gateway") // tune to your naming convention
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "tomcat.exe", "nginx.exe", "svchost.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName, ReportId
| order by TimeGenerated desc
-- Hunt engineering workstations and gateway management hosts for unexpected
-- shell processes spawned by service/application parents, and live ICS-port connections.
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(cmd|powershell|pwsh|wscript|cscript)\.exe'
AND CommandLine =~ '(?i)(whoami|net user|nltest|ipconfig|arp -a|certutil|bitsadmin|curl|wget)'
-- Correlate with active connections to substation protocol ports (DNP3, MMS, 104, Modbus)
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemotePort in (20000, 102, 2404, 502)
AND Status =~ 'ESTABLISHED'
# Verify and harden engineering workstations managing Schneider Electric substation devices.
# Run on Windows engineering workstations / EPAS-GTW management hosts. Requires elevation.
# 1. Enumerate installed Schneider Electric software for advisory cross-reference
Write-Host "=== Schneider Electric Installed Software ===" -ForegroundColor Cyan
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,
HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName -match 'Schneider|Easergy|MiCOM|EcoStruxure|PowerLogic|Saitel' } |
Select-Object DisplayName, DisplayVersion, InstallDate |
Format-Table -AutoSize
# 2. Audit which hosts have active sessions to ICS protocol ports
Write-Host "=== Active ICS Protocol Connections (DNP3/MMS/104/Modbus) ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Established |
Where-Object { $_.RemotePort -in 20000,102,2404,502 } |
Select-Object LocalAddress, LocalPort, RemoteAddress, RemotePort, OwningProcess,
@{N='Process';E={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}} |
Format-Table -AutoSize
# 3. Verify host firewall blocks unsolicited inbound ICS protocol traffic
Write-Host "=== Firewall Rules Permitting ICS Ports Inbound ===" -ForegroundColor Cyan
Get-NetFirewallRule -Direction Inbound -Action Allow -Enabled True |
Get-NetFirewallPortFilter |
Where-Object { $_.LocalPort -in 20000,102,2404,502 } |
Select-Object Protocol, LocalPort, RemotePort
# 4. Confirm Windows event forwarding / audit policy captures process creation with command line
Write-Host "=== Command-Line Audit Policy Check ===" -ForegroundColor Cyan
$cl = Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\Audit' `
-Name ProcessCreationIncludeCmdLine_Enabled -ErrorAction SilentlyContinue
if ($cl.ProcessCreationIncludeCmdLine_Enabled -ne 1) {
Write-Warning 'Process command-line auditing is DISABLED. Enable via GPO: '
'Administrative Templates > System > Audit Process Creation > Include command line.'
} else { Write-Host 'Command-line auditing: ENABLED' -ForegroundColor Green }
Remediation
- Obtain the authoritative patch matrix. Download the CSAF document and the vendor advisory linked from CISA ICSA-26-169-07 and from Schneider Electric's cybersecurity notification portal. Map every affected product/version pair against your OT asset inventory. If you do not have a current inventory of relay firmware versions, that gap is your first remediation item.
- Apply vendor firmware/software updates in maintenance windows. Coordinate relay and gateway firmware updates with protection engineering — firmware changes on protective devices require re-testing of protection schemes before return to service. Follow Schneider Electric's update instructions exactly; do not improvise on live protection equipment.
- Enforce zone segmentation now (do not wait for the patch). Per CISA's standing ICS guidance: these devices must never be internet-exposed; the SCADA DMZ must be the only IT-reachable path; and engineering workstations should be the only hosts permitted to initiate configuration sessions to relays. Verify with the firewall hunt above.
- Block and hunt for exposure. Query Shodan/Censys from your threat intel tooling for your organization's IP space exposing ports 20000, 2404, 502, and 102. Any result is an incident, not a finding.
- Rotate credentials on affected devices and gateways where the advisory indicates authentication-related impact, and enforce strong, unique credentials — default or shared relay passwords remain one of the most common findings in OT assessments.
- Verify backups of relay configurations and settings files. Before patching, export and archive current protection settings so you can validate post-update integrity and roll back if a firmware update misbehaves.
- Monitor KEV and vendor updates. Subscribe to CISA ICS advisory feeds and Schneider Electric's security notification service. If any CVE from this advisory is added to the KEV catalog, treat remediation as an emergency change.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.