Schneider Electric SCADAPack RTUs credential flaw
CISA/Schneider advisory warns SCADAPack x70 and 3xx series RTUs expose credentials via legacy Secure Lock, risking unauthorized access to device configuration.
Sourcecisa.gov — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA republished a Schneider Electric CPCERT advisory (SEVD-2026-251-03) describing an insufficiently protected credentials vulnerability (CVE-2026-81861, CWE-522) affecting SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 Remote Terminal Unit (RTU) product lines, used across critical manufacturing and energy sectors worldwide. The flaw resides in the legacy Secure Lock functionality and could allow unauthorized access to RTU configuration, resulting in loss of confidentiality of authentication information and RTU functionality.
No evidence of active exploitation is indicated in the advisory. Schneider Electric recommends migrating from the legacy Secure Lock feature to Role-Based Access Control (RBAC), which is the recommended access control mechanism for these devices. Additional mitigations include network segmentation between trusted and untrusted networks, enabling the RTU firewall service, following the SCADAPack Cybersecurity Guide (hardening and secured communication sections), and standard ICS best practices such as isolating control networks from business networks and internet, using VPNs for remote access, and physical access controls. The vulnerability was reported to CISA by researcher Abhinav Agarwal.
Mentioned in this report
Source reporting: https://www.cisa.gov/news-events/ics-advisories/icsa-26-258-04
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs