CVE-2026-9650: Credential Exposure in Schneider Electric EasyLogic T150 and Saitel DP

Technical summary

This vulnerability is classified as CWE-522 (Insufficiently Protected Credentials). The flaw allows unauthenticated network access to retrieve credentials that are inadequately protected within device firmware or system files. The CVSS 3.1 vector (7.5/HIGH) reflects high confidentiality impact with network-based attack capability, no authentication required, and low attack complexity. The credential exposure itself is the primary risk vector; subsequent device compromise depends on the attacker obtaining physical access to the affected hardware.

Business impact

Exposed credentials create pathways for attackers to gain control of critical industrial control equipment. For organizations relying on Schneider Electric EasyLogic T150 or Saitel DP devices, this vulnerability could lead to unauthorized access, operational disruption, and potential manipulation of industrial processes. The impact is magnified in critical infrastructure sectors (energy, water, manufacturing) where device availability and integrity directly affect business continuity.

Affected systems

This vulnerability affects Schneider Electric EasyLogic T150 (both the device and its firmware) and Schneider Electric Saitel DP (device and firmware). Organizations should inventory instances of these products across their infrastructure, including both current deployments and archived or backup units, as any device running vulnerable firmware remains a potential attack vector.

Exploitability

The vulnerability is exploitable over the network without requiring authentication or user interaction, which is why the CVSS score is elevated despite the physical-access requirement for full device compromise. An attacker can retrieve credentials remotely; however, using those credentials to actively compromise the device typically requires physical proximity or network connectivity to the device itself. The lack of KEV status indicates it is not yet publicly documented as exploited in the wild, but the straightforward nature of credential extraction (no authentication barrier) means exploitation could be weaponized relatively quickly if detailed technical information becomes public.

Remediation

Patch vulnerable firmware immediately. Verify available firmware updates from Schneider Electric for both EasyLogic T150 and Saitel DP products. In parallel, implement network segmentation to restrict access to these devices from untrusted networks and change any credentials that may have been exposed. Consider deploying additional monitoring on affected devices to detect unauthorized access attempts.

Patch guidance

Check the Schneider Electric security advisory and product support portal for patched firmware versions specific to EasyLogic T150 and Saitel DP. Firmware updates should be applied in a controlled maintenance window given the industrial control nature of these devices. Verify patch applicability for your specific device models and firmware versions before deployment. Test patches in a non-production environment first to ensure no operational impact.

Detection guidance

Monitor network traffic to and from EasyLogic T150 and Saitel DP devices for unusual authentication patterns or credential-related API calls. Review device logs and firmware access logs for evidence of credential file reads. Network intrusion detection systems should flag any suspicious queries to device configuration or firmware directories. If credentials are suspected compromised, monitor downstream systems for login attempts using exposed credentials.

Why prioritize this

Despite not being listed on the KEV catalog, this vulnerability merits high priority due to its HIGH severity rating, network-exploitable nature, and targeting of industrial control devices critical to infrastructure operations. The zero-authentication requirement for credential extraction and the direct pathway to system compromise make this a significant risk. Organizations should treat this as urgent, especially if EasyLogic T150 or Saitel DP devices are deployed in production environments.

Risk score, explained

The CVSS 3.1 score of 7.5/HIGH reflects a network-based attack vector with low complexity, no authentication needed, and high confidentiality impact. Although the description mentions physical access as a precondition for full device compromise, the credential exposure itself is a standalone, remotely exploitable risk that warrants the elevated score. The vulnerability does not directly cause integrity or availability loss (hence no impact in those categories), but the exposed credentials serve as a stepping stone for further attacks.

Frequently asked questions