Which versions of EasyLogic T150 are affected by CVE-2026-9650?

Organizations deploying Schneider Electric EasyLogic T150 and Saitel DP controllers in manufacturing and critical infrastructure face credential exposure that enables attackers to compromise…

How to fix or mitigate CVE-2026-9650?

Within 24 hours: Inventory all EasyLogic T150 and Saitel DP devices in operation and assess physical security controls around affected systems. Within 7 days: Implement network segmentation to restrict credential-based device access and enable enhanced monitoring per vendor advisory SEVD-2026-160-02. Within 30 days: Monitor Schneider Electric security advisories for patch availability; apply patch immediately upon vendor release, or implement full compensating controls including credential rotation and hardware-level access restrictions.

EasyLogic T150 CVE-2026-9650

Q: What is the CVSS score of CVE-2026-9650?

CVE-2026-9650 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-39430 HIGH

Insufficiently Protected Credentials (CWE-522)

2026-06-25 schneider

GHSA-w2q4-93g6-j5vm

Authentication Bypass Schneider Electric Easylogic T150 Formerly Saitel Dr Remote Terminal Unit Controller Saitel Dp Remote Terminal Unit Controller

8.7

CVSS 4.0 · Vendor: schneider

Severity by source

Vendor (schneider) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.2 MEDIUM

Extracting credentials from firmware/system files and the stated physical-access requirement imply local proximity (AV:L), no auth (PR:N), and confidentiality-only impact (C:H, I/A:N).

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (schneider).

CVSS VectorVendor: schneider

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 25, 2026 - 16:21 vuln.today

DescriptionCVE.org

CWE-522 Insufficiently Protected Credentials vulnerability that could cause unauthorized access and exposure of sensitive information when unauthenticated attacker accesses credentials stored within firmware or system files. With this credential an attacker could subsequently compromise the device if they have physical access to the device.

AnalysisAI

Credential exposure in Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units & Controllers allows an unauthenticated attacker to recover credentials that are insufficiently protected within device firmware or system files (CWE-522). The recovered credentials can then be used to fully compromise the device when the attacker also has physical access. No public exploit identified at time of analysis and the issue is not listed in CISA KEV; vendor advisory SEVD-2026-160-02 covers the affected OT products.

Technical ContextAI

The affected products are industrial Remote Terminal Units (RTUs) and controllers used in SCADA/OT environments for telemetry and remote control of field equipment. The root cause is CWE-522 (Insufficiently Protected Credentials): authentication secrets are stored in firmware images or system files without adequate protection (e.g., weak/no encryption or hashing, or storage in retrievable locations), so anyone who can read those artifacts can extract usable credentials. Per the CPE data, two distinct product lines are in scope - cpe:2.3:a:schneider_electric:easylogic_t150_(formerly_saitel_dr)_remote_terminal_unit_&_controller and cpe:2.3:a:schneider_electric:saitel_dp_remote_terminal_unit_&_controller - across all versions enumerated (no fixed version bound is provided in the CPE).

RemediationAI

Apply the fixed firmware/version specified in Schneider Electric advisory SEVD-2026-160-02 (https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-02.pdf); no exact fixed version number is provided in the supplied data, so treat the advisory as the authoritative source for the patched build and rotate any credentials that may have been exposed after updating. Until patched, restrict and monitor physical access to the RTUs/controllers since physical access is the stated prerequisite for the impactful compromise step (trade-off: operational maintenance access becomes more cumbersome), and segment the devices onto an isolated OT/management network with firewall rules that limit reachability to engineering workstations only (trade-off: may break remote telemetry/management workflows that rely on broader connectivity). Also restrict the ability to extract or read firmware/system files to authorized maintenance personnel and rotate device credentials so any previously embedded secrets are invalidated.