Schneider Electric SCADAPack x70 Products: 1 CVE, Medium 6.5
Summary
CISA reports 1 vulnerability in Schneider Electric SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and 3 more. Weakness type: Insufficiently Protected Credentials. Schneider Electric is aware of a vulnerability in its SCADAPack x70 products. The SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R and SCADAPack 57x products are Remote Terminal Units that provide communication capabilities for remote monitoring and control. Highest CVSS v3 score: 6.5 (Medium), exploitable over the network.
At a glance
- Vendor
- Schneider Electric
- Products
- SCADAPack 47x, SCADAPack 47xi, SCADAPack 47xd, SCADAPack 470R, SCADAPack 57x, SCADAPack 3xx, SCADAPack 32
- CVEs
- CVE-2026-81861
- Highest CVSS v3
- 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Critical Manufacturing, Energy
- Deployed
- Worldwide
- Vendor HQ
- France
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-81861 | Insufficiently Protected Credentials | 6.5 | – | No | CVE-2026-81861 |
Affected products (7)
- SCADAPack 47x
- SCADAPack 47xi
- SCADAPack 47xd
- SCADAPack 470R
- SCADAPack 57x
- SCADAPack 3xx
- SCADAPack 32
Vendor fixes and mitigations (from advisory)
- Mitigation: Implement the Role-Based Access Control (RBAC) feature and follow the SCADAPack documentation sections Security Guidelines for Administrators and Working with Role-Based Access Control. RBAC is the recommended access control mechanism for SCADAPack 47x devices and should be used in place of the Secure Lock feature. The Secure Lock feature is legacy functionality retained for backward compatibility with existing deployments and should only be used where required to support legacy system requirements. Consult the SCADAPack Cybersecurity Guide, including the SCADAPack Hardening and Secured Commun link
- Mitigation: Ensure setup of network segmentation to restrict access between trusted and untrusted networks and implementation of the RTU Firewall Service to restrict unauthorized access to services. Consult the SCADAPack Cybersecurity Guide, including the SCADAPack Hardening and Secured Communication sections. In addition, implement all best practices referenced in the SCADAPack Cybersecurity Guide. Documentation available in [RemoteConnect and SCADAPack x70 Utilities | Schneider Electric](https://www.se.com/ww/en/download/document/RemoteConnect/) link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
- CISA advisory ICSA-26-258-04
- Machine-readable CSAF record
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-251-03&p_enDocType=Secur
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-251-03&p_enDocType=Secur
- https://www.se.com/ww/en/download/document/7EN52-0390/
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.