CVE-2026-102250: CWE-345: Insufficient Verification of Data Authenticity in Schneider Electric Sage RTU 1410

This vulnerability, classified as CWE-345 (Insufficient Verification of Data Authenticity), affects Schneider Electric Sage RTU 1410. It arises because the device does not adequately verify the authenticity of firmware during updates initiated by an authorized admin user. Exploitation could allow an attacker with administrative privileges to upload tampered firmware, potentially gaining control over the device's operations. The CVSS 4.0 base score is 8.6, indicating high severity with network attack vector, low attack complexity, no user interaction, and high impacts on confidentiality, integrity, and availability.

An attacker with authorized administrative access can upload modified firmware to the Sage RTU 1410 device, which may result in full control over the device. This compromises the integrity and availability of the device and could disrupt its intended operation.

No patch or official remediation information is currently available. Patch status is not yet confirmed — check Schneider Electric's vendor advisory for current remediation guidance. Until a fix is released, restrict administrative access to trusted personnel and monitor firmware update procedures closely.