# CVE-2026-9650: Schneider Electric EasyLogic and Saitel RTU unprotected credentials

Source: https://junglewise.ai/threats/cve-2026-9650-schneider-electric-easylogic-and-saitel-rtu-unprotected  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-25. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-9650 · Severity: info · CVSS 8.7 · Published 2026-06-25

Schneider Electric industrial controllers contain a security flaw where sensitive login credentials are not properly protected within the device's internal files. An attacker could potentially discover these credentials and use them to gain unauthorized access to the equipment. If an attacker also has physical access to the device, they could use this information to fully compromise the controller, potentially disrupting industrial operations or accessing sensitive data.

Vendors: [Schneider Electric](https://junglewise.ai/threats/vendors/schneider-electric).

## Quick answers

**Is CVE-2026-9650 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9650 being exploited in the wild.

**How severe is CVE-2026-9650?** Informational severity, with a CVSS score of 8.7, published 25 June 2026.

**Which products and versions are affected?** Schneider Electric EasyLogic T150 Version 11.06.30 and prior; Schneider Electric Saitel DP Version 11.06.35 and prior.

**Is there a fix for CVE-2026-9650?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-9650 attacked?** It is attacked over the network or with physical access, in device firmware.

**Am I affected by CVE-2026-9650?** Check whether you run Schneider Electric EasyLogic T150 or Schneider Electric Saitel DP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CWE-522 (Insufficiently Protected Credentials) vulnerability exists in the firmware and system files of Schneider Electric EasyLogic T150 and Saitel DP Remote Terminal Units (RTUs). An unauthenticated attacker can access credentials stored within these files over the network. While the initial exposure provides sensitive information, full device compromise requires the attacker to have physical access to the hardware to utilize the recovered credentials. The vulnerability affects EasyLogic T150 versions 11.06.30 and prior, and Saitel DP versions 11.06.35 and prior.

## Affected products

- Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller Version 11.06.30 and prior
- Schneider Electric Saitel DP Remote Terminal Unit & Controller Version 11.06.35 and prior

## Timeline

- 2026-06-25: disclosed: Initial disclosure by Schneider Electric and NVD publication.

## References

- [https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-02.pdf](https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-160-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-160-02.pdf)

## Related threats

- [Schneider Electric RTU incorrect permission assignment in system files](https://junglewise.ai/threats/cve-2026-9651-schneider-electric-rtu-incorrect-permission-assignment-in-system)