Schneider Electric patches path traversal in RTU firmware
Schneider Electric fixed a path traversal flaw (CVE-2026-6865) in EasyLogic T150 and Saitel DP RTU firmware that could expose sensitive files to attackers.
Schneider Electric has released firmware updates to address CVE-2026-6865, a path traversal vulnerability affecting EasyLogic T150 (formerly Saitel DR) and Saitel DP Remote Terminal Unit and Controller products deployed worldwide in energy and critical manufacturing sectors. The flaw stems from improper handling of user-supplied input during server-side file path processing, potentially allowing attackers to gain unauthorized access to sensitive files on affected devices.
Affected versions include all EasyLogic T150 firmware up to and including version 11.06.31, and all Saitel DP firmware up to version 11.06.36. Schneider Electric has released patched firmware versions 11.06.32 and 11.06.37 respectively, available through the company's Customer Care Center. Both updates require a device reboot to apply.
For organizations unable to immediately patch, Schneider Electric recommends implementing strict credential controls for all users, ensuring network isolation per product security guidelines, and restricting device exposure from the internet. CISA reports no known active exploitation of this vulnerability at the time of the advisory's release.
Mentioned in this report
Detection guidance
Potential Path Traversal Exploitation Attempt via HTTP Request
Detects HTTP requests containing directory traversal sequences that may indicate exploitation attempts against vulnerable server-side file path handling such as CVE-2026-6865 in RTU/ICS web management interfaces. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Potential Path Traversal Exploitation Attempt via HTTP Request
id: 383a72bb-b5cb-5ce2-ac6a-b9653cd02c59
status: experimental
description: 'Detects HTTP/web requests containing directory traversal sequences (e.g.
../, %2e%2e%2f, encoded variants) in the URI path or query string.
This pattern is consistent with exploitation attempts against server-side file path
processing flaws such as CVE-2026-6865 affecting
Schneider Electric EasyLogic T150 and Saitel DP RTU/controller web management interfaces.
No active exploitation has been observed in the
wild at time of writing; this rule provides early-warning coverage should exploitation
attempts occur, particularly against
internet-exposed or improperly isolated OT/ICS network segments.
'
references:
- Schneider Electric advisory for CVE-2026-6865
author: Vorant
logsource:
category: proxy
product: windows
falsepositives:
- Legitimate security scanning or vulnerability assessment tools testing for path
traversal
- Web application penetration testing against the same infrastructure
- Misconfigured applications that legitimately use relative path segments in URLs
level: medium
tags:
- attack.t1190
detection:
selection:
c-uri|contains:
- ../
- ..\
- '%2e%2e%2f'
- '%2e%2e/'
- ..%2f
- '%2e%2e%5c'
filter:
c-uri|contains:
- /vendor/
- /node_modules/
condition: selection and not filter
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-169-04
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free