CVE-2026-102250
Quick assessment
Affected
Schneider Electric Sage RTU 1410
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
CWE-345：数据真实性验证不足漏洞存在，可能导致在授权管理员用户开始固件更新流程时，上传被篡改的固件，从而可能导致攻击者获得对设备的控制权。
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 6
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Schneider Electric | Sage RTU 1410 | All versions prior to version C3414-500-S02L0 |
affected |
| Schneider Electric | Sage RTU 1430 | All versions prior to version C3414-500-S02L0 |
affected |
| Schneider Electric | Sage RTU 1450 | All versions prior to version C3414-500-S02L0 |
affected |
| Schneider Electric | Sage RTU 2400 | All versions prior to version C3414-500-S02L0 |
affected |
| Schneider Electric | Sage RTU 3030 Magnum | All versions prior to version C3414-500-S02L0 |
affected |
| Schneider Electric | Sage RTU 4400 | All versions prior to version C3414-500-S02L0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-102250
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对数据真实性的验证不充分
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Schneider Electric | Sage RTU 1410 | All versions prior to version C3414-500-S02L0 | - |
|
| Schneider Electric | Sage RTU 1430 | All versions prior to version C3414-500-S02L0 | - |
|
| Schneider Electric | Sage RTU 1450 | All versions prior to version C3414-500-S02L0 | - |
|
| Schneider Electric | Sage RTU 2400 | All versions prior to version C3414-500-S02L0 | - |
|
| Schneider Electric | Sage RTU 3030 Magnum | All versions prior to version C3414-500-S02L0 | - |
|
| Schneider Electric | Sage RTU 4400 | All versions prior to version C3414-500-S02L0 | - |
|
II. Public POCs for CVE-2026-102250
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-102250
请登录查看更多情报信息。
Other References for CVE-2026-102250 (1)
IV. Related Vulnerabilities
Same vendor: Schneider Electric
-
CVE-2026-3869
Schneider Electric Modicon M580 授权问题漏洞 -
CVE-2026-81861
Schneider Electric SCADAPack 47x 信任管理问题漏洞 -
CVE-2026-77120
Schneider Electric PowerLogic T300 命令注入漏洞 -
CVE-2026-19233
Schneider Electric EcoStruxure IT Data Center Expert 服务端请求伪造 -
CVE-2026-8044
Schneider Electric EcoStruxure IT Data Center Expert 命令注入漏洞
Same weakness: CWE-345
-
CVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can -
CVE-2026-102695
OmniFaces: Forged combined-resource IDs and related output/p -
CVE-2026-110607
BizSpring Shop through commit cf22d39daaf1 Payment Bypass vi -
CVE-2026-109365
Zebra before 6.4.0 Denial of Service via Same-Hash Forged Bl -
CVE-2026-109359
Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Expo
V. Comments for CVE-2026-102250
No comments yet