Schneider Electric EasyLogic T150 and Saitel DP

View CSAF Summary Successful exploitation this vulnerability could allow an attacker to gain unauthorized access to sensitive files The following versions of Schneider Electric EasyLogic T150 and Saitel DP are affected: Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller Firmware installed on Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller (All versions) vers:semver/<=11.06.31 (CVE-2026-6865) Schneider Electric Saitel DP Remote Terminal Unit & Controller Firmware installed on Schneider Electric Saitel DP Remote Terminal Unit & Controller (All versions) vers:semver/<=11.06.36 (CVE-2026-6865) CVSS Vendor Equipment Vulnerabilities v3 7.1 Schneider Electric Schneider Electric EasyLogic T150 and Saitel DP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Background Critical Infrastructure Sectors: Energy, Critical Manufacturing Countries/Areas Deployed: Worldwide Company Headquarters Location: France Vulnerabilities Expand All + CVE-2026-6865 CWE-22: Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal") vulnerability that could cause unauthorized access to sensitive files when user-supplied input is improperly handled during server-side file path processing. View CVE Details Affected Products Schneider Electric EasyLogic T150 and Saitel DP Vendor: Schneider Electric Product Version: Schneider Electric Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller Firmware installed on Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller (All versions): vers:semver/<=11.06.31, Schneider Electric Schneider Electric Saitel DP Remote Terminal Unit & Controller Firmware installed on Schneider Electric Saitel DP Remote Terminal Unit & Controller (All versions): vers:semver/<=11.06.36 Product Status: known_affected Remediations Mitigation Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk: Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller Firmware (vers:semver/<=11.06.31) installed on Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller (All versions): Version 11.06.32 of EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller includes a fix for this vulnerability and is available for download here: Mitigation Contact Schneider Electric's Customer Care Center to download this firmware. Reboot needed: Yes Mitigation Schneider Electric Saitel DP Remote Terminal Unit & Controller Firmware (vers:semver/<=11.06.36) installed on Schneider Electric Saitel DP Remote Terminal Unit & Controller (All versions): Version 11.06.37 of Saitel DP Remote Terminal Unit & Controller includes a fix for this vulnerability and is available for download here: Mitigation Contact Schneider Electric's Customer Care Center to download this firmware. Reboot needed: Yes Mitigation All affected products: If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: Ensure strict credential controls, even for low privilege users. Mitigation Ensure isolation and credentials are in place, as per the product's security recommendations. Mitigation The following product versions have been fixed: Firmware Version 11.06.32 installed on EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller are fixed versions for CVE-2026-6865 Mitigation Firmware Version 11.06.37 installed on Saitel DP Remote Terminal Unit & Controller are fixed versions for CVE-2026-6865 Mitigation For more information see the associated Schneider Electric CPCERT security advisory SEVD-2026-132-03 Improper Limitation of a Pathname to a Restricted Directory vulnerability on Remote Terminal Unit and Controller Products - SEVD-2026-132-03 PDF Version, Improper Limitati