As reported by CISA in advisory ICSA-26-181-04, two significant vulnerabilities have been disclosed affecting Schneider Electric's EasyLogic T150 and Saitel DP Remote Terminal Units — devices widely deployed across energy generation, transmission, and critical manufacturing environments globally. At Shield53, we consider this disclosure particularly high-stakes given the operational role these RTUs play in industrial control system (ICS) architectures.
Vulnerability Snapshot
- CVE-2026-9650
- Insufficiently Protected Credentials — credentials accessible within firmware or system files without authentication
Affected: EasyLogic T150 ≤ v11.06.30 | Saitel DP RTU ≤ v11.06.35
CVSS v3 Score: 7.5 (High) - CVE-2026-9651
- Incorrect Permission Assignment for Critical Resource — improper access controls on sensitive system resources
Affected: EasyLogic T150 ≤ v11.06.31 | Saitel DP RTU ≤ v11.06.37
CVSS v3 Score: 7.5 (High) - Vendor
- Schneider Electric
- Deployment Scope
- Worldwide — Critical Manufacturing and Energy sectors
- Active Exploitation Observed
- Not confirmed at time of publication — but exposure is unauthenticated, elevating urgency
Why This Matters Beyond the CVSS Score
A CVSS score of 7.5 is significant in any context, but in ICS/OT environments, the real-world impact potential vastly exceeds what numeric scores capture. RTUs like the EasyLogic T150 and Saitel DP are the nerve endings of industrial control systems — they translate physical process signals into digital commands and vice versa. Compromising credentials stored within these devices doesn't just enable unauthorized access to a single node; it can provide a foothold into broader SCADA architectures, historian servers, and even safety instrumented systems depending on network segmentation.
What makes CVE-2026-9650 particularly concerning is the unauthenticated nature of the attack vector. An adversary with network access to the RTU — even without valid credentials — can extract stored credentials directly from firmware or system files. In environments where OT network segmentation is incomplete (which is far more common than security teams would like to admit), this creates a scenario where a single exposed RTU becomes a master key.
Shield53 Perspective: Credential exposure in embedded firmware is not a novel vulnerability class — but it remains one of the most persistently exploited in OT environments precisely because patching cycles in industrial settings are measured in months or years, not days.
Who Is Most at Risk
Immediate Actions
1. Inventory and Version Verification
Immediately audit all deployed EasyLogic T150 and Saitel DP units for firmware version. Any device running at or below the affected version thresholds should be treated as a priority remediation target. This inventory should extend to spare and standby units that may not be actively monitored.
2. Apply Vendor Patches
Contact Schneider Electric's product security team and consult the official advisory for available firmware updates. Reference the CISA advisory ICSA-26-181-04 and Schneider Electric's security portal for patch availability and upgrade procedures specific to your deployment configuration.
3. Network Isolation as Immediate Mitigation
Where patching cannot be immediately applied — which is operationally realistic in many ICS environments — enforce strict network segmentation. RTUs should not be directly reachable from IT networks, internet-facing systems, or third-party remote access infrastructure. Deploy unidirectional gateways or data diodes where feasible.
4. Credential Rotation and Audit
Assume any credentials stored on affected firmware versions may be compromised. Rotate all associated credentials — including those used for upstream SCADA connections, engineering workstations, and remote access accounts — as a precautionary measure, even prior to confirmed exploitation.
5. Enhanced Monitoring
Deploy anomaly detection on traffic to and from affected RTUs. Look specifically for unauthorized configuration changes, unusual authentication attempts against SCADA systems using RTU-associated credentials, and any lateral movement patterns originating from OT network segments.
Shield53 Recommendations
- Treat unauthenticated credential exposure in OT devices as a Critical operational risk regardless of the vendor-assigned CVSS score
- Establish a formal OT patch management program with defined SLAs for High and Critical severity ICS advisories — waiting for scheduled maintenance windows is not acceptable for vulnerabilities of this nature
- Engage your ICS vendor account team to understand the full patch roadmap and whether compensating controls are officially endorsed
- Include RTU firmware integrity checks in your regular OT security assessment cadence
- Review and update your ICS incident response playbooks to include RTU compromise scenarios, particularly credential theft leading to upstream SCADA access
The convergence of IT and OT environments continues to expand the attack surface of critical infrastructure. Vulnerabilities like these are a reminder that the security posture of an RTU in a remote substation is now directly linked to enterprise-level risk. Organizations operating these devices should act with appropriate urgency.
