CVE-2026-77120

CVE-2026-77120 is an OS command injection vulnerability (CWE-78) in which the operating system console of an affected product improperly processes user-controlled input; it was published by Schneider Electric's security team (CNA [email protected]). Exploitation requires an authenticated user with high privileges to interact with the OS console on a device where SSH is enabled, after which crafted input is executed as an operating system command. A successful attack escalates the session to root and permits unauthorized execution of administrative functions, with high impact on system confidentiality, integrity, and availability (CVSS 4.0: 8.7 High, local attack vector, high privileges required, no user interaction). The affected product names and version ranges are not stated in the available data, so defenders should consult Schneider Electric's advisory for precise scoping. No public proof-of-concept is known, the flaw is not listed in the CISA KEV catalog, and no exploitation has been reported.

What to do: Monitor Schneider Electric's security notifications for CVE-2026-77120 and apply the vendor's firmware/software update as soon as one is published; the affected product and fixed versions are not yet stated in the available data. In the interim, restrict SSH access to trusted administrative hosts, disable SSH on devices that do not require it, and limit OS console access to trusted high-privileged accounts. Audit deployed devices for SSH enablement, since only configurations with SSH enabled and console access are exposed to this flaw.