CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request.

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request.

Schneider Electric is aware of multiple vulnerabilities in its SAGE RTU products. The SAGE RTU products are hardware devices that collect utility substation information from different devices and passes it along to a SCADA software platform. Failure to apply the remediation provided below may risk total compromise of the impacted device, leading to loss of data, loss of operation, or impacts to the performance of the device.

Schneider Electric is aware of multiple vulnerabilities in its SAGE RTU products. The SAGE RTU products are hardware devices that collect utility substation information from different devices and passes it along to a SCADA software platform. Failure to apply the remediation provided below may risk total compromise of the impacted device, leading to loss of data, loss of operation, or impacts to the performance of the device.