This vulnerability is a CWE‑331 insufficient entropy flaw that can lead to unauthorized access when an attacker on the network exploits weaknesses in session‑management protections. The flaw allows an attacker to predict or guess session identifiers, thereby hijacking authenticated sessions or forging authentication tokens, and causes loss of confidentiality and integrity of control system operations.

Affected products include Schneider Electric Easergy C5, Easergy MiCOM C264, Easergy MiCOM P30, Easergy MiCOM P40, EasyLogic T150, EcoStruxure Power Automation System User Interface, EcoStruxure Power Automation System Gateway, EcoStruxure Power Operation, PowerLogic P5 Protection Relay, PowerLogic P7 Protection and Control Platform, PowerLogic T300, PowerLogic T500, Saitel DP, and iPMFLS. Specific firmware or software versions that contain the flaw are not listed, so all current releases lacking an explicit patch should be considered vulnerable.

The CVSS score of 8.7 signals a high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, indicating that exploit activity may not yet be widespread, although the risk remains significant for any attacker with network access. Based on the description, it is inferred that an attacker who can reach the device over the network and interact with its session‑management endpoint could exploit the low randomness and hijack sessions. Prompt patching is therefore advised.