This vulnerability, classified as CWE-331 (Insufficient Entropy), exists in Schneider Electric Easergy MiCOM C264 devices. It involves weak randomness in session management mechanisms, which could be exploited by a network attacker to bypass protections and gain unauthorized access. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality and integrity. The affected versions are all versions up to 7.33 inclusive. No official fix or remediation level has been published by Schneider Electric as of the publication date.

An attacker on the network could exploit the insufficient entropy in session management to bypass protections and gain unauthorized access to the affected device. This could lead to compromise of confidentiality and integrity of the system. The vulnerability does not require privileges or authentication but does require user interaction. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level has been published, users should monitor Schneider Electric advisories for updates. Until a patch is available, consider limiting network exposure of affected devices and applying compensating controls as appropriate.