CISA ICS Advisory ICSA-26-258-04: Schneider Electric SCADAPack x70 RTUs Exposed to Credential Extraction

Executive Summary & Critical Infrastructure Exposure

The Cybersecurity and Infrastructure Security Agency (CISA) has released Industrial Control Systems (ICS) Advisory ICSA-26-258-04, alerting critical infrastructure asset owners to a significant credential security vulnerability affecting Schneider Electric SCADAPack x70 Remote Telemetry Units (RTUs): CVE-2026-81861.

Schneider Electric SCADAPack RTUs function as ruggedized edge automation controllers designed for harsh, remote industrial environments. They monitor sensor instrumentation, calculate flow rates, regulate valves, and transmit real-time telemetry back to central Supervisory Control and Data Acquisition (SCADA) master stations across critical sectors, including Oil & Gas transmission pipelines, municipal water and wastewater treatment facilities, and electrical power distribution substations.

Assigned a CVSS v3 base score of 7.5 High and classified under CWE-522 (Insufficiently Protected Credentials), the flaw permits adversaries with network access to the RTU's telemetry or engineering ports to extract stored authentication credentials. Possession of these credentials grants adversaries the ability to masquerade as authorized engineering workstations, modify RTU logic programs, and transmit false telemetry readings to human-machine interfaces (HMIs).

Vulnerability Dissection: Insecure Non-Volatile Memory Storage

SCADAPack x70 RTUs support multiple industrial telemetry protocols, including Modbus RTU/TCP, DNP3, and IEC 60870-5-104. To facilitate communications with central SCADA hosts and engineering software (RemoteConnect), the devices store user account configurations, pre-shared keys, and access passwords in non-volatile flash memory.

According to Schneider Electric's security notification (SEVD-2026-258-01), specific firmware iterations preceding version 9.6.1 fail to adequately encrypt or salt administrative credentials stored within internal configuration tables. When a remote adversary interrogates the RTU's diagnostic services over TCP port 502 (Modbus) or proprietary engineering protocols:

1. The diagnostic interface responds to unauthenticated or low-privilege diagnostic requests with memory dump segments containing credential blocks.
2. The stored password hashes are protected using weak, deprecated hashing algorithms with no unique per-device cryptographic salt.
3. Attackers reverse the hashes via pre-computed lookup tables within seconds, yielding the master engineering credentials.

Industrial Cyber-Physical Attack Scenarios

In industrial automation environments adhering to the Purdue Model, RTUs sit at Level 1 (Basic Control) and Level 2 (Area Supervisory Control). Compromising an RTU grants adversaries high-consequence cyber-physical disruption capabilities:

• Loss of View (Telemetry Spoofing): Threat actors manipulate DNP3 analog input values, sending false normal pressure readings to the central pipeline control room while over-pressurizing physical pipeline segments.
• Loss of Control (Actuator Manipulation): Adversaries transmit unauthorized command sequences to discrete outputs, closing municipal water treatment valves or tripping substation circuit breakers.
• Logic Tampering: Attackers upload malicious Ladder Logic or Structured Text programs via RemoteConnect that alter emergency shutdown (ESD) setpoints, preventing safety systems from engaging during physical over-pressure events.

Affected Models & Firmware Remediation Matrix

IEC 62443 Hardening Guidelines for OT Operators

Asset owners and operational technology engineers must implement the following mitigation roadmap adhering to IEC 62443-3-3 (System Security Requirements) and IEC 62443-3-2 (Zones and Conduits):

1. Flash Patched Firmware Baseline (Version 9.6.1+)

Apply the official firmware update SCADAPack x70 v9.6.1 via Schneider Electric RemoteConnect. The updated firmware implements AES-256 encrypted credential storage and enforces SHA-256 salted hashing for all local user accounts.

2. Industrial Zone Segmentation & Conduit Protection (IEC 62443-3-2)

Isolate all remote RTU deployments behind industrial cellular routers or security appliances supporting IPsec/OpenVPN encryption. SCADAPack communication ports (DNP3 port 20000, Modbus port 502) must never be directly accessible across public cellular APNs:

# Industrial Firewall Rule (Conduit Protection):
# Permit DNP3/Modbus only from authenticated SCADA Master IP
iptables -A FORWARD -p tcp -s 10.50.10.10 -d 10.50.100.25 --dport 20000 -j ACCEPT
iptables -A FORWARD -p tcp -s 10.50.10.10 -d 10.50.100.25 --dport 502 -j ACCEPT
iptables -A FORWARD -d 10.50.100.25 -j DROP

3. Enforce DNP3 Secure Authentication (SAv5)

Configure SCADAPack RTUs and master stations to enforce DNP3 Secure Authentication version 5 (SAv5) according to IEEE 1815-2012 standards. This ensures that all critical control commands require cryptographic challenge-response validation, preventing unauthorized command execution even if network traffic is intercepted.

4. Disable Unused Diagnostic and Web Services

In the RemoteConnect device configuration, disable unneeded HTTP web server interfaces, Telnet, and unencrypted FTP services, minimizing the exposed attack surface on remote field controllers.