OTPulse

Schneider Electric EcoStruxure Panel Server

Plan PatchCVSS 7.5ICS-CERT ICSA-26-160-03May 12, 2026
Schneider ElectricEnergy
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Schneider Electric has identified an authentication bypass vulnerability in EcoStruxure Panel Server models PAS800, PAS800V2, PAS600, PAS600V2, and PAS400 running firmware version 002.005.000 and earlier. The vulnerability allows unauthorized access to sensitive operational information and configurations on the gateway without valid credentials. Versions affected are those with firmware version 002.005.000 or lower. Version 002.006.000 corrects this issue and is available for all affected models; firmware upgrade requires device reboot.

What this means
What could happen
An attacker could bypass authentication on the EcoStruxure Panel Server and gain unauthorized access to sensitive operational data or configurations for the gateway.
Who's at risk
Electric utilities and energy facilities using Schneider Electric EcoStruxure Panel Server models (PAS800, PAS800V2, PAS600, PAS600V2, PAS400) for gateway and edge control applications. These devices are critical for managing connections between field devices and cloud applications; compromised authentication could expose operational parameters and enable unauthorized control.
How it could be exploited
An attacker with network access to the Panel Server could send specially crafted requests that circumvent the authentication mechanism, allowing them to access the gateway's management interface without valid credentials. This would expose operational configurations, control parameters, and potentially allow further system manipulation.
Prerequisites
  • Network access to the EcoStruxure Panel Server management interface (typically port 80/443)
  • No valid credentials required
remotely exploitableno authentication requiredlow complexity
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (5)
5 with fix
ProductAffected VersionsFix Status
EcoStruxure Panel Server PAS800≤ 002.005.000vers:intdot/=002.006.000
EcoStruxure Panel Server PAS800V2≤ 002.005.000vers:intdot/=002.006.000
EcoStruxure Panel Server PAS600≤ 002.005.000vers:intdot/=002.006.000
EcoStruxure Panel Server PAS600V2≤ 002.005.000vers:intdot/=002.006.000
EcoStruxure Panel Server PAS400≤ 002.005.000vers:intdot/=002.006.000
Remediation & Mitigation
0/6
Do now
0/1
WORKAROUNDRestrict network access to the Panel Server management interface to authorized engineering workstations and administrative networks only
Schedule — requires maintenance window
0/5

Patching may require device reboot — plan for process interruption

EcoStruxure Panel Server PAS800
HOTFIXUpdate EcoStruxure Panel Server PAS800 to firmware version 002.006.000 or later
HOTFIXUpdate EcoStruxure Panel Server PAS800V2 to firmware version 002.006.000 or later
EcoStruxure Panel Server PAS600
HOTFIXUpdate EcoStruxure Panel Server PAS600 to firmware version 002.006.000 or later
HOTFIXUpdate EcoStruxure Panel Server PAS600V2 to firmware version 002.006.000 or later
EcoStruxure Panel Server PAS400
HOTFIXUpdate EcoStruxure Panel Server PAS400 to firmware version 002.006.000 or later
View full CISA ICS-CERT advisory
API: /api/v1/advisories/b62c3dba-9b7b-4e33-8c84-d0a043e53957

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Schneider Electric EcoStruxure Panel Server | CVSS 7.5 - OTPulse