Schneider Electric Saitel RTU privilege escalation via config file
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Privilege escalation flaw in Schneider Saitel DR/DP RTUs allows authenticated local attackers arbitrary code execution via configuration modification.
Schneider Electric Saitel DR and Saitel DP Remote Terminal Units contain an improper privilege management vulnerability (CVE-2025-8453) that allows an authenticated attacker with console access to escalate privileges to root and execute arbitrary code. The vulnerability exists in how privileged daemon processes handle configuration files that can be modified by engineer-level users. The flaw affects Saitel DR RTU versions 11.06.29 and prior, and Saitel DP RTU versions 11.06.34 and prior. These devices are deployed worldwide across critical infrastructure sectors including communications, energy, manufacturing, and transportation.
Schneider Electric has released patched firmware (version 11.06.30) for the Saitel DR RTU. For the Saitel DP RTU, a remediation plan is under development. The vulnerability requires local console access and is not remotely exploitable. No active exploitation in the wild has been reported. Defenders should immediately restrict console access to trusted users, enforce strict file permissions on configuration files, and apply available patches. Organizations should also consider upgrading to the newer PowerLogic T500 Substation Controller.
Mentioned in this report
Detection guidance
Setuid/Setgid Bit Set on File via chmod
Detects chmod setting the setuid or setgid bit on a file, a common step after local privilege escalation through a privileged daemon that trusts a user-writable config file, as with CVE-2025-8453 on Saitel RTUs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Setuid/Setgid Bit Set on File via chmod
id: 1512eebc-2a6e-5f48-a840-8de4637e7c71
status: experimental
description: Detects chmod setting the setuid or setgid bit on a file. After abusing
a privileged daemon that trusts a user-writable configuration file (for example
CVE-2025-8453 on Saitel RTUs), an attacker running code as root commonly plants
a SUID binary or shell for persistent elevation. The report gives no specific file
names, so this rule generalises on the chmod mode pattern.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-03
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1548.001
logsource:
category: process_creation
product: linux
detection:
selection_img:
Image|endswith: /chmod
selection_mode_symbolic:
CommandLine|contains:
- ' u+s'
- ' g+s'
- ' +s '
- ' a+s'
- ' ug+s'
selection_mode_octal:
CommandLine|re: \s[2467][0-7]{3}\s
filter_pkg:
ParentImage|endswith:
- /dpkg
- /rpm
- /apt
- /yum
- /dnf
condition: selection_img and 1 of selection_mode_* and not filter_pkg
falsepositives:
- Package installation or firmware update scripts that legitimately set setuid on
helper binaries
- Administrators deliberately configuring setgid directories for shared group access
level: medium
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-03
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs