The vulnerability is an insufficient verification of data authenticity flaw (CWE-345) that permits an attacker to upload a modified firmware image during an authorized administrator’s firmware update procedure. This flaw allows the attacker to replace legitimate firmware with malicious code, potentially taking full control of the device’s logic and functions. The impact is remote code execution, enabling the attacker to alter device behavior, compromise data integrity, and disrupt industrial processes.

Affected models include Schneider Electric Sage RTU 1410, 1430, 1450, 2400, 3030 Magnum, and 4400. No specific firmware version information is provided, so all current firmware releases are potentially vulnerable until a vendor‑issued fix or update is applied.

The CVSS score of 8.6 classifies this as high severity, and the vulnerability is listed as not in KEV, with no EPSS data available, indicating the exploitation probability is currently unknown. The likely attack vector is privileged access within the admin network; an insider or attacker who gains administrative credentials may trigger the firmware upload. Because the flaw permits control over device operation, the risk is significant for critical infrastructures using these RTU units.