# CVE-2026-0667: Schneider Electric SCADAPack code execution in Modbus TCP protocol handling

Source: https://junglewise.ai/threats/cve-2026-0667-schneider-electric-scadapack-code-execution-in-modbus-tcp-protocol  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-29. Updated: 2026-07-29  
License: CC BY 4.0 with a link back

CVE-2026-0667 · Severity: info · CVSS 9.3 · Published 2026-07-29

Schneider Electric SCADAPack controllers and RemoteConnect software are affected by a critical vulnerability in their handling of Modbus TCP communications. These devices are typically used in industrial environments to monitor and control critical infrastructure like water or power systems. A successful exploit could allow an attacker to remotely shut down the equipment, steal sensitive operational data, or take full control of the device's operations.

Vendors: [Schneider Electric](https://junglewise.ai/threats/vendors/schneider-electric).

## Quick answers

**Is CVE-2026-0667 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-0667 being exploited in the wild.

**How severe is CVE-2026-0667?** Informational severity, with a CVSS score of 9.3, published 29 July 2026.

**Which products and versions are affected?** Schneider Electric RemoteConnect Prior to R3.4.2; Schneider Electric SCADAPack 47x Prior to R3.4.2 (Firmware prior to 9.12.2); Schneider Electric SCADAPack 47xi Prior to R3.4.2 (Firmware prior to 9.12.2); Schneider Electric SCADAPack 57x All versions.

**Is there a fix for CVE-2026-0667?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-0667 attacked?** It is attacked over the network, in device firmware.

**Am I affected by CVE-2026-0667?** Check whether you run Schneider Electric RemoteConnect, Schneider Electric SCADAPack 47x, Schneider Electric SCADAPack 47xi or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions) exists within the Modbus TCP protocol implementation of Schneider Electric SCADAPack 47x/57x series and RemoteConnect software. The flaw is triggered during the processing of Modbus TCP communications, where the system fails to properly handle specific exceptional conditions. A remote, unauthenticated attacker can exploit this over the network to achieve arbitrary code execution, cause a denial of service (DoS) condition, or compromise the confidentiality and integrity of the system. Schneider Electric has released firmware updates (R3.4.2 / 9.12.2) to address the issue for most affected models.

## Affected products

- Schneider Electric SCADAPack 47x Prior to R3.4.2 (Firmware prior to 9.12.2)
- Schneider Electric SCADAPack 47xi Prior to R3.4.2 (Firmware prior to 9.12.2)
- Schneider Electric SCADAPack 57x All versions
- Schneider Electric RemoteConnect Prior to R3.4.2

## Timeline

- 2026-07-29: disclosed
- 2026-07-29: advisory

## References

- [https://download.se.com/files?p_Doc_Ref=SEVD-2026-041-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-041-01.pdf](https://download.se.com/files?p_Doc_Ref=SEVD-2026-041-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-041-01.pdf)

## Related threats

- [Schneider Electric SCADAPack x70 insufficiently protected credentials](https://junglewise.ai/threats/cve-2026-81861-schneider-electric-scadapack-x70-insufficiently-protected)