OTPulse

Schneider Electric SCADAPack x70 Products

MonitorCVSS 6.5ICS-CERT ICSA-26-258-04Sep 8, 2026
Schneider ElectricEnergy
Attack path
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionRequired
Summary

Schneider Electric SCADAPack x70 Remote Terminal Units contain a vulnerability in the Secure Lock access control feature that could allow unauthorized access to RTU configuration. The vulnerability affects the SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, and 32 product lines. Secure Lock is legacy functionality; Schneider Electric recommends migration to the Role-Based Access Control (RBAC) feature for access management. No vendor security updates are available; mitigation relies on proper configuration and network controls.

What this means
What could happen
An attacker with network access could bypass the Secure Lock feature and gain unauthorized access to RTU configuration, potentially altering process settings or disabling remote monitoring and control on critical grid infrastructure.
Who's at risk
This affects operators of Schneider Electric SCADAPack Remote Terminal Units (RTUs) used in energy sector infrastructure for remote monitoring and control. Any facility using SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx, or 32 series devices with legacy Secure Lock configuration is at risk.
How it could be exploited
An attacker on the network could interact with the RTU's Secure Lock authentication mechanism and circumvent it through the vulnerability, gaining access to configuration settings without valid credentials. This requires network reachability to the RTU but no prior credentials.
Prerequisites
  • Network access to the RTU on the same network or routable segment
  • RTU must be configured with Secure Lock enabled (legacy configuration)
  • User interaction may be required depending on the specific attack method
remotely exploitableno authentication requiredlow complexityaffects grid communication infrastructure
Exploitability
Unlikely to be exploited — EPSS score 0.5%
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (7)
7 pending
ProductAffected VersionsFix Status
SCADAPack 470RAll versionsNo fix yet
SCADAPack 57xAll versionsNo fix yet
SCADAPack 3xxAll versionsNo fix yet
SCADAPack 32All versionsNo fix yet
SCADAPack 47xAll versionsNo fix yet
SCADAPack 47xiAll versionsNo fix yet
SCADAPack 47xdAll versionsNo fix yet
Remediation & Mitigation
0/5
Do now
0/1
HARDENINGEnable and configure the RTU Firewall Service to restrict unauthorized access to device services and limit network exposure
Schedule — requires maintenance window
0/3

Patching may require device reboot — plan for process interruption

HARDENINGEnable and configure Role-Based Access Control (RBAC) on SCADAPack devices as the primary access control mechanism, following Schneider Electric's documented Security Guidelines for Administrators
HARDENINGDisable or retire the Secure Lock feature on all SCADAPack devices and migrate to RBAC-based access control
HARDENINGReview and apply all security best practices from the SCADAPack Cybersecurity Guide, particularly the Hardening and Secured Communication sections
Long-term hardening
0/1
HARDENINGImplement network segmentation to isolate RTU management traffic from untrusted networks and limit access to authorized administrative systems only
View full CISA ICS-CERT advisory
API: /api/v1/advisories/611897d7-7cfb-498b-b7c8-7292ce02e50c

Get OTPulse briefings by email

Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.

Schneider Electric SCADAPack x70 Products | CVSS 6.5 - OTPulse