CVE-2026-9651: File Permission Vulnerability in Schneider Electric EasyLogic T150 and Saitel DP

Technical summary

This CWE-732 vulnerability stems from incorrect permission assignment on critical system resources. The affected Schneider Electric products (EasyLogic T150 and Saitel DP, including their firmware variants) fail to properly restrict file access controls, allowing privileged local users to read password hash files without authorization. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) reflects local-only attack surface, high privilege requirement, and confidentiality impact without integrity or availability consequences. No user interaction is required once access is obtained.

Business impact

For organizations operating Schneider Electric EasyLogic T150 or Saitel DP systems, this vulnerability poses a credential exposure risk. If a privileged local attacker or compromised administrator account reads exposed password hashes, they gain material for offline cracking attacks or hash-passing techniques, potentially leading to unauthorized account access and lateral movement. The impact is most acute in environments where these devices control critical processes and where multi-factor authentication or strong hash formats are not in place. Ransomware operators and persistent threat actors targeting industrial environments should be monitored, though the vulnerability is not currently tracked as weaponized in the wild.

Affected systems

Schneider Electric EasyLogic T150 and Saitel DP devices are affected, including both the hardware platforms and their firmware images. Organizations should audit inventory records to identify deployed instances of these products. Note that the vulnerability requires local system access, so air-gapped or strictly network-isolated deployments face lower risk than those accessible to facility technicians, contractors, or remote management sessions.

Exploitability

Exploitation requires high-level local privileges (administrator or equivalent) and direct access to the affected system's file system. There is no remote attack vector, no user interaction needed, and no special tools required beyond standard file-reading capabilities. However, the privilege barrier is substantial—an attacker must either compromise a privileged account first or have legitimate local access. The CVSS score of 4.4 (MEDIUM) appropriately reflects this constrained but meaningful risk; the vulnerability is not trivial, but it is not an easy win for remote adversaries.

Remediation

Organizations should prioritize patching affected Schneider Electric devices according to vendor guidance (verify patch availability and versions against Schneider Electric security advisories). In parallel, implement compensating controls: restrict local administrative access through strong authentication and role-based access control, deploy file integrity monitoring to detect unauthorized hash file reads, apply the principle of least privilege to system accounts, and consider network segmentation to limit lateral movement if compromise occurs. Review audit logs for any unauthorized file access attempts.

Patch guidance

Contact Schneider Electric and consult official security advisories for patch versions and deployment procedures specific to your EasyLogic T150 and Saitel DP firmware revisions. Patches should be tested in a non-production environment first, given the critical nature of industrial control systems. Plan maintenance windows to minimize operational disruption. If patches are not yet available, implement the compensating controls described above until patching is feasible.

Detection guidance

Monitor system audit logs for unauthorized access attempts to sensitive password hash files on affected Schneider Electric devices. Deploy file integrity monitoring (FIM) tools to alert on any reads or modifications to critical system files containing credentials. Track privileged account activity and session logs for anomalous access patterns. Use network monitoring to detect unusual outbound connections from affected devices that could indicate compromise post-exploitation. Establish a baseline of expected file access patterns to improve anomaly detection.

Why prioritize this

Although CVE-2026-9651 carries a MEDIUM CVSS score and does not appear in the Known Exploited Vulnerabilities (KEV) catalog, it merits prompt attention because it directly exposes password hashes to privileged insiders or post-compromise attackers. In industrial environments where credential reuse is common and account compromise can cascade across connected systems, hash exposure represents a material threat. Prioritize patching and hardening for EasyLogic T150 and Saitel DP systems that manage critical processes or are accessible to multiple administrators.

Risk score, explained

The CVSS 3.1 score of 4.4 reflects a vulnerability with high confidentiality impact (exposure of password hashes), but limited by a requirement for high-level local privileges and no impact on integrity or availability. The lack of remote exploitability significantly reduces the attack surface. However, the real-world risk depends on your operational environment: if EasyLogic T150 or Saitel DP devices are widely accessible to facility staff or if administrator accounts are not strongly isolated, the practical risk is higher than the base score suggests.

Frequently asked questions