# Schneider Electric RTU Vulnerabilities Expose Hardcoded Credentials in Critical Infrastructure Worldwide
## The Threat
Schneider Electric has disclosed two critical vulnerabilities affecting EasyLogic T150 and Saitel DP Remote Terminal Units (RTUs) — networked industrial control devices deployed across power generation, manufacturing, and water treatment facilities worldwide. The vulnerabilities stem from insufficiently protected credentials embedded directly in firmware and system files, allowing unauthenticated attackers to extract sensitive authentication material without exploitation tools or advanced techniques.
Remote Terminal Units are critical infrastructure workhorses: they collect sensor data, control switches, and relay commands across industrial networks. Compromising an RTU means gaining direct control over physical processes — production lines, power distribution, water pumps, or pipeline pressure regulators. An attacker with extracted credentials can persistence indefinitely and move laterally through SCADA networks that often lack segmentation or advanced threat detection.
The vulnerability is particularly dangerous because it requires no active network exploitation. An attacker with brief physical access to a powered device — during maintenance, supply chain transit, or unauthorized facility access — can extract credentials from readable firmware files. Once extracted, those credentials become valid across multiple devices and systems, potentially allowing remote compromise from anywhere on the corporate network.
## Severity and Impact
| Aspect | Details |
|--------|---------|
| CVE Identifier | CVE-2026-9650, CVE-2026-9651 |
| CVSS Score | 7.5 (High) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| Attack Vector | Network / Physical Access to Device |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| CWE Classification | CWE-522 (Insufficiently Protected Credentials), CWE-732 (Incorrect Permission Assignment for Critical Resource) |
| Impact Type | Confidentiality Loss, Unauthorized Access |
| Affected Sectors | Critical Manufacturing, Energy, Water & Wastewater |
## Affected Products
Schneider Electric EasyLogic T150 (formerly Saitel DR)
Schneider Electric Saitel DP
All versions deployed globally are affected regardless of network configuration or access controls.
## Mitigations
Immediate Actions Required:
1. Firmware Updates — Apply Schneider Electric's vendor-supplied patches immediately upon availability. EasyLogic T150 administrators should upgrade to version 11.06.32 or later; Saitel DP administrators should upgrade to version 11.06.38 or later. Both patches require device reboot. Contact Schneider Electric's Customer Care Center to obtain firmware files from SEVD-2026-160-02.
2. Credential Rotation — Assume all embedded credentials have been compromised if devices have been accessible to untrusted parties. Change all authentication material associated with affected RTUs, related SCADA accounts, and downstream systems once firmware is patched.
3. Network Segmentation — Isolate affected RTUs to a dedicated industrial control network with strict ingress/egress filtering. Restrict administrative access to industrial network from corporate networks using air-gapped jump hosts or secure remote access solutions designed for critical infrastructure.
4. Physical Access Controls — Restrict unsupervised physical access to RTU chassis. Require badge authentication and surveillance logging for equipment rooms. Implement chain-of-custody procedures for maintenance and transport to prevent supply chain credential extraction.
5. Firmware Verification — Before deploying patches, verify firmware integrity using cryptographic signatures provided by Schneider Electric. Do not accept firmware from unofficial sources or download links.
6. Monitoring and Detection — Deploy network monitoring to detect authentication attempts using extracted credentials. Flag any login activity from unexpected network segments or using service accounts outside normal operating windows.
## References
---
## HackWire Analysis
This advisory exposes a recurring plague in industrial control systems: credential hardcoding treated as an acceptable design choice rather than a critical security flaw. Schneider Electric's RTUs are battle-hardened devices deployed in tens of thousands of substations and manufacturing facilities, yet credentials remain extractable from firmware by anyone with a device in hand and thirty seconds of access.
The pattern is familiar. In 2021, Siemens disclosed similar hardcoded credentials in TIA Portal engineering workstations. In 2023, Schneider Electric itself patched hardcoded credentials in Modbus Plus modules. Each time, the vendor's response is the same: patches are released, firmware updates are applied, and the industry moves on. What doesn't change is the underlying design philosophy that treats firmware files like executable code rather than cryptographic material.
The risk window here is substantial. A CVSS 7.5 vulnerability in a device that controls critical infrastructure isn't theoretical. A motivated attacker — competing manufacturer, nation-state, financially motivated threat actor — with supply chain access or insider coordination can extract credentials during manufacturing, at the distribution warehouse, or during a maintenance visit. Those credentials are then valid indefinitely across the customer's entire fleet until discovered through active monitoring or forensic analysis.
What's missing from the advisory is equally important: no mention of multi-factor authentication, credential encryption at rest, or secure key derivation. Modern RTUs could enforce hardware-backed credential storage, API authentication separate from firmware credentials, or time-limited access tokens. Instead, Schneider Electric is patching the symptom while the disease remains untreated in product architecture.
For defenders: patch urgently, rotate credentials aggressively, and audit your SCADA network's credential inventory. For device manufacturers reading this: hardcoded credentials should be grounds for regulatory non-compliance. Until the industry treats credential security as a mandatory design requirement — not a feature request — critical infrastructure will remain exposed to what amounts to publicly available vulnerability against common equipment.
— HackWire Editorial
---
## Related Coverage