SCADAPack 300E Series RTU
Plan Patch7.5SEVD-2021-313-01Nov 9, 2021
Attack VectorNetwork
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary
Schneider Electric SCADAPack 300E Series RTUs contain an improper error handling vulnerability (CWE-754) in firmware versions 8.18.1 and earlier. An attacker with network access can send a specially crafted request that causes the RTU to crash or restart, resulting in a denial-of-service condition. This interrupts the RTU's ability to monitor and control remote assets. The vulnerability is fixed in firmware version 8.19.1.
What this means
What could happen
An attacker with network access could trigger a denial-of-service condition that forces the RTU to restart, temporarily stopping remote monitoring and control of critical assets until the device comes back online.
Who's at risk
Energy utility companies, particularly those operating remote RTU-based monitoring systems for substations, pipelines, or remote generation/distribution assets. Any organization using SCADAPack 300E Series RTUs in supervisory control systems is affected.
How it could be exploited
An attacker on the network sends a specially crafted request to the RTU that triggers a failure condition (CWE-754: Improper error handling). The device crashes or restarts, interrupting communication with the central control system and the remote assets it monitors.
Prerequisites
- Network access to the RTU on its operational port
- No authentication required to send the malicious request
remotely exploitableno authentication requiredlow complexityaffects availability of critical asset monitoring
Exploitability
Low exploit probability (EPSS 0.4%)
Affected products (1)
ProductAffected VersionsFix Status
SCADAPack 300E Series RTUs firmware V8.18.1 and prior≤ 8.18.18.19.1
Remediation & Mitigation
0/4
Do now
0/1HARDENINGMaintain current backups of RTU configuration before applying patches
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpgrade SCADAPack 300E Series RTU firmware to version 8.19.1 or later
HOTFIXPlan firmware upgrade during a scheduled maintenance window due to required reboot
Long-term hardening
0/1HARDENINGTest firmware update in offline lab or development environment before deploying to production RTUs
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/6c8cdcb1-22c8-4ed2-9817-3b9e3c4fdf91