# Schneider Electric Saitel RTU privilege escalation via config file

Published: 2025-08-28 · Severity: routine · Sectors: energy, manufacturing, telecommunications, transportation, infrastructure
Canonical: https://vorant.io/reports/6d62830d-9294-58be-9f6d-dc58a11058cc/schneider-electric-saitel-rtu-privilege-escalation-via-config-file

> Privilege escalation flaw in Schneider Saitel DR/DP RTUs allows authenticated local attackers arbitrary code execution via configuration modification.

Schneider Electric Saitel DR and Saitel DP Remote Terminal Units contain an improper privilege management vulnerability (CVE-2025-8453) that allows an authenticated attacker with console access to escalate privileges to root and execute arbitrary code. The vulnerability exists in how privileged daemon processes handle configuration files that can be modified by engineer-level users. The flaw affects Saitel DR RTU versions 11.06.29 and prior, and Saitel DP RTU versions 11.06.34 and prior. These devices are deployed worldwide across critical infrastructure sectors including communications, energy, manufacturing, and transportation.

Schneider Electric has released patched firmware (version 11.06.30) for the Saitel DR RTU. For the Saitel DP RTU, a remediation plan is under development. The vulnerability requires local console access and is not remotely exploitable. No active exploitation in the wild has been reported. Defenders should immediately restrict console access to trusted users, enforce strict file permissions on configuration files, and apply available patches. Organizations should also consider upgrading to the newer PowerLogic T500 Substation Controller.

## Mentioned in this report

- Vulnerabilities: CVE-2025-8453

## Detection guidance (public sample)

### Setuid/Setgid Bit Set on File via chmod

ATT&CK: T1548.001

Detects chmod setting the setuid or setgid bit on a file, a common step after local privilege escalation through a privileged daemon that trusts a user-writable config file, as with CVE-2025-8453 on Saitel RTUs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Setuid/Setgid Bit Set on File via chmod
id: 1512eebc-2a6e-5f48-a840-8de4637e7c71
status: experimental
description: Detects chmod setting the setuid or setgid bit on a file. After abusing
  a privileged daemon that trusts a user-writable configuration file (for example
  CVE-2025-8453 on Saitel RTUs), an attacker running code as root commonly plants
  a SUID binary or shell for persistent elevation. The report gives no specific file
  names, so this rule generalises on the chmod mode pattern.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-03
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1548.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith: /chmod
  selection_mode_symbolic:
    CommandLine|contains:
    - ' u+s'
    - ' g+s'
    - ' +s '
    - ' a+s'
    - ' ug+s'
  selection_mode_octal:
    CommandLine|re: \s[2467][0-7]{3}\s
  filter_pkg:
    ParentImage|endswith:
    - /dpkg
    - /rpm
    - /apt
    - /yum
    - /dnf
  condition: selection_img and 1 of selection_mode_* and not filter_pkg
falsepositives:
- Package installation or firmware update scripts that legitimately set setuid on
  helper binaries
- Administrators deliberately configuring setgid directories for shared group access
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-25-240-03

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/6d62830d-9294-58be-9f6d-dc58a11058cc/schneider-electric-saitel-rtu-privilege-escalation-via-config-file.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup