CVE-2026-102250

Severity: high (CVSS 8.6 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-13 · updated 2026-10-16
Weakness: CWE-345

Description

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.

Affected products

Schneider Electric Sage RTU 1410: All versions prior to version C3414-500-S02L0
Schneider Electric Sage RTU 1430: All versions prior to version C3414-500-S02L0
Schneider Electric Sage RTU 1450: All versions prior to version C3414-500-S02L0
Schneider Electric Sage RTU 2400: All versions prior to version C3414-500-S02L0
Schneider Electric Sage RTU 3030 Magnum: All versions prior to version C3414-500-S02L0
Schneider Electric Sage RTU 4400: All versions prior to version C3414-500-S02L0

References

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-286-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-286-02.pdf

Get alerted when CVE-2026-102250 or the next vulnerability affects your stack