Critical 9.8 CVSS Schneider Electric Flaw Exposes SCADA and Data Center Systems

Schneider Electric has exposed the curtain on two significant vulnerabilities affecting critical infrastructure tools. From remote terminal units (RTUs) used in monitoring to scalable management software, the risks range from total system denial to remote code execution.

The most alarming discovery is CVE-2026-0667, a vulnerability sporting a CVSS score of 9.8. This “Improper Check for Unusual or Exceptional Conditions” flaw strikes at the heart of the SCADAPack™ x70 series, which are essential for remote communication and control.

The bulletin warns that:

“Failure to apply the remediations provided below may risk unauthorized access to your RTU, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller“.

Because this vulnerability targets the Modbus TCP protocol, it could allow an attacker to trigger arbitrary code execution or a total system blackout.

Affected Products:

• SCADAPack™ 57x: All versions.

• RemoteConnect: Versions prior to R3.4.2.

Schneider Electric has released Version R3.4.2 (Firmware 9.12.2) to patch the hole. For those unable to update immediately, the vendor urges users to “implement the RTU firewall service to block all unauthorized access” and “disable the logic debug service”.

The second advisory focuses on the EcoStruxure IT Data Center Expert (DCE), a platform responsible for collecting and distributing critical device information. Tracked as CVE-2025-13957 (CVSS 7.2), this issue involves the presence of hard-coded credentials.

While serious, this exploit has a specific set of requirements. According to the advisory:

“A hard-coded credentials vulnerability exists that could lead to information disclosure and remote code execution when SOCKS Proxy is enabled, and administrator credentials and PostgreSQL database credentials are known“.

Notably, the SOCKS Proxy feature is disabled by default, providing a layer of protection for users who haven’t tinkered with that specific setting.

Affected Products:

• EcoStruxure IT Data Center Expert: Version 9.0 and prior.

Security teams should move to Version 9.1 to eliminate the risk. If an immediate update isn’t possible, ensure the SOCKS Proxy remains disabled and follow the hardening guidelines in the official Security Handbook.