SAE IT-systems FW-50 Remote Telemetry Unit (RTU)

An attacker with network access to the RTU's web interface could run arbitrary code on the device or read sensitive files and configuration data that would normally be protected. This could allow unauthorized changes to telemetry settings, data exfiltration, or disruption of remote monitoring capabilities for water or power distribution systems.

Water utilities and electric utilities operating SAE IT-systems FW-50 Remote Telemetry Units (RTUs) are affected. These devices are typically used for remote monitoring and control of distributed infrastructure such as pump stations, distribution lines, and remote substations. Any organization relying on this RTU model for telemetry collection should assess their exposure immediately.

An attacker sends malicious input (HTML, path traversal, or command injection) through the web server interface on the RTU. The web server does not properly validate or sanitize the input, allowing the attacker to execute arbitrary code on the CPU or access the device's file system to read configuration files, credentials, or system data.