Schneider SAGE RTU CVE-2026-102250

Exploitation requires an authorized administrative user to initiate the device's firmware update procedure and supply a firmware image; the device fails to verify the authenticity of that image, so a modified image is accepted. The decisive limiting factor is the PR:H requirement - the attacker must already hold admin-level authentication to the RTU's management interface, meaning this is realistically reachable only by insiders, holders of stolen admin credentials, or via a compromised engineering workstation with device access. No special non-default configuration is indicated; the weakness is in the standard update path across SAGE RTU 1410/1430/1450/2400/3030 Magnum/4400 models.

The vendor-provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H) yields 8.6 (High), driven by total compromise of confidentiality, integrity, and availability of the device if exploited - appropriate given that malicious firmware grants full control of an RTU. The single most important mitigating signal is PR:H: exploitation requires an already-authorized administrative user, so this is an insider or compromised-credential threat rather than a remotely-triggerable pre-auth flaw. No EPSS score, CISA KEV listing, or public POC is present in the supplied intelligence, so there is no evidence of active or opportunistic exploitation - status is 'no public exploit identified at time of analysis.' Signals are internally consistent (high technical impact but high privilege requirement), so this is a genuine but access-gated priority: critical to patch for operators of these SCADA RTUs because the consequence (control of grid/utility field equipment) is severe, yet the admin-privilege prerequisite means it is not a mass-exploitation candidate. Note AV:N is retained despite the operation being an admin-initiated firmware update - treat the network vector as the vendor's assessment of the management interface, not independently confirmed as remotely reachable without admin access.

An attacker who has obtained authorized administrator credentials for a Schneider Electric SAGE RTU (via credential theft, insider access, or a compromised engineering workstation) crafts a modified firmware image and submits it through the normal firmware update procedure. Because the device does not sufficiently verify firmware authenticity (CWE-345), the tampered image is accepted and installed, giving the attacker persistent low-level control of the remote terminal unit. No public exploit code is identified at time of analysis.