Schneider Electric Sage RTU: Insufficient verification of firmware authenticity
Summary
Several Schneider Electric Sage RTU remote terminal units (1410, 1430, 1450, 2400, 3030 Magnum and 4400) do not sufficiently verify the authenticity of uploaded firmware. An authorized admin user starting a firmware update could upload modified firmware, which could give an attacker control over the device. Exploitation requires admin privileges and the attacker must be able to reach the device during the update procedure.
Affected
- Sage RTU 1410, 1430, 1450, 2400, 3030 Magnum, 4400
- All versions prior to C3414-500-S02L0
Fixed in
- Firmware C3414-500-S02L0 or later (according to the "prior to" threshold in the CVE record; vendor advisory wording not verified)
Workaround
- Unknown. No CVE-specific workaround found in the sources.
- Restrict who can access the web interface and admin accounts.
- Check whether Telnet and FTP are enabled and disable unused services.
Exploitation
- No known exploitation.
- No public exploit listed in the PSIRT record; not in CISA KEV.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- EPSS approx. 0.0015.
Our recommendation
- Schedule the firmware update to C3414-500-S02L0 or later, after verifying the fix in the vendor advisory SEVD-2026-286-02.
- Restrict admin access and network exposure of Sage RTUs now; keep them out of office and internet-facing networks.
- Check whether any Sage RTU is in use and who holds admin accounts.
- Monitor for unexpected firmware changes or admin logins.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Schneider Electric Security Notification SEVD-2026-286-02 download.schneider-electric.com
- PSIRT CVE record CVE-2026-102250 psirt.com
- Canadian Cyber Centre Advisory AV26-1051 www.cyber.gc.ca
- CISA VulnRichment record (HOL Guard) hol.org
- Strix CVE record CVE-2026-102250 www.strix.ai
- CIRCL/Vulners CVE record CVE-2026-102250 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 08:30.
Original description (NVD)
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.