EUVD-2026-39431
GHSA-633j-w347-p8v6
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local attack vector with high privileges required; only confidentiality is impacted via hash disclosure; no integrity or availability effect.
Primary rating from Vendor (schneider).
CVSS VectorVendor: schneider
Lifecycle Timeline
1DescriptionCVE.org
CWE-732 Incorrect Permission Assignment for Critical Resource vulnerability that could cause unauthorized disclosure of password hashes and potential account compromise when an attacker with privileged local access reads improperly protected system files.
AnalysisAI
Incorrect file permission assignment on Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units exposes password hashes stored in system files to unauthorized reading by privileged local users. An attacker who has already obtained privileged local access to the RTU can read these improperly protected files, extract credential hashes, and perform offline cracking to achieve account compromise. No public exploit code exists at time of analysis, and the vulnerability has not been listed in CISA KEV, but the high confidentiality impact on credential material in OT/ICS environments warrants attention.
Technical ContextAI
CWE-732 (Incorrect Permission Assignment for Critical Resource) describes a class of vulnerability where sensitive files - in this case, system files containing password hashes - are stored with overly permissive access controls that allow unauthorized principals to read them. The affected products, per CPE strings cpe:2.3:a:schneider_electric:easylogic_t150_(formerly_saitel_dr)_remote_terminal_unit_&_controller and cpe:2.3:a:schneider_electric:saitel_dp_remote_terminal_unit_&_controller, are industrial Remote Terminal Units (RTUs) and controllers manufactured by Schneider Electric, used in operational technology (OT) and industrial control system (ICS) environments for SCADA and substation automation. These embedded devices run specialized firmware where file system permission enforcement may differ from general-purpose operating systems. The root cause is that the system files holding hashed credentials were not restricted to the owning service or privileged system process, making them readable by other high-privilege accounts.
RemediationAI
Consult Schneider Electric Security Advisory SEVD-2026-160-02, available at https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-02.pdf, for the primary remediation guidance including any patched firmware version. Exact fix versions are not independently confirmed from the available data - apply only the firmware version specified in the official advisory. As a compensating control pending patching, enforce strict physical and logical access controls to limit who can obtain privileged local access to these RTU devices; restrict administrative accounts to named individuals and audit privileged account usage. If credential hashes have been exposed, force password rotation across all affected devices and audit for reused credentials on connected systems. Note that restricting access to the RTU management interface does not remediate the underlying file permission flaw and should be treated as a temporary measure only.
Credential exposure in Schneider Electric EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Units & Cont
Unauthorized file disclosure in Schneider Electric Saitel DP and EasyLogic T150 (formerly Saitel DR) Remote Terminal Uni
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today