CVE-2026-102250 - Vulnerability Details - OpenCVE

CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

No data.

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-286-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-286-02.pdf

History

Tue, 13 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.
Weaknesses		CWE-345
References		https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-286-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-286-02.pdf
Metrics		cvssV4_0 `{'score': 8.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: schneider

Published: 2026-10-13T14:51:48.442Z

Updated: 2026-10-13T14:51:48.442Z

Reserved: 2026-09-28T19:04:55.353Z

Link: CVE-2026-102250

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-13T15:17:29.940

Modified: 2026-10-13T15:17:29.940

Link: CVE-2026-102250

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

CWE-345

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-102250", "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "state": "PUBLISHED", "assignerShortName": "schneider", "dateReserved": "2026-09-28T19:04:55.353Z", "datePublished": "2026-10-13T14:51:48.442Z", "dateUpdated": "2026-10-13T14:51:48.442Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb", "shortName": "schneider", "dateUpdated": "2026-10-13T14:51:48.442Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity", "type": "CWE"}]}], "affected": [{"vendor": "Schneider Electric", "product": "Sage RTU 1410", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}], "defaultStatus": "unaffected"}, {"vendor": "Schneider Electric", "product": "Sage RTU 1430", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}], "defaultStatus": "unaffected"}, {"vendor": "Schneider Electric", "product": "Sage RTU 1450", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}], "defaultStatus": "unaffected"}, {"vendor": "Schneider Electric", "product": "Sage RTU 2400", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}], "defaultStatus": "unaffected"}, {"vendor": "Schneider Electric", "product": "Sage RTU 3030 Magnum", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}], "defaultStatus": "unaffected"}, {"vendor": "Schneider Electric", "product": "Sage RTU 4400", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device."}]}], "references": [{"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-286-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-286-02.pdf"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Sage RTU 1410", "vendor": "Schneider Electric", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}]}, {"defaultStatus": "unaffected", "product": "Sage RTU 1430", "vendor": "Schneider Electric", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}]}, {"defaultStatus": "unaffected", "product": "Sage RTU 1450", "vendor": "Schneider Electric", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}]}, {"defaultStatus": "unaffected", "product": "Sage RTU 2400", "vendor": "Schneider Electric", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}]}, {"defaultStatus": "unaffected", "product": "Sage RTU 3030 Magnum", "vendor": "Schneider Electric", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}]}, {"defaultStatus": "unaffected", "product": "Sage RTU 4400", "vendor": "Schneider Electric", "versions": [{"status": "affected", "version": "All versions prior to version C3414-500-S02L0"}]}], "source": "[email protected]"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CWE-345: Insufficient Verification of Data Authenticity vulnerability exists that could allow modified firmware to be uploaded when an authorized admin user begins a firmware update procedure which could result in control over the device."}], "id": "CVE-2026-102250", "lastModified": "2026-10-13T15:17:29.940", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "[email protected]", "type": "Secondary"}]}, "published": "2026-10-13T15:17:29.940", "references": [{"source": "[email protected]", "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2026-286-02&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2026-286-02.pdf"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Received", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-345"}], "source": "[email protected]", "type": "Primary"}]}