Technical impact
This vulnerability arises from improper limitation of a pathname to a restricted directory, allowing an attacker to manipulate file paths and obtain files that should remain hidden. The flaw enables unauthorized access to sensitive files, thereby compromising confidentiality and potentially leading to higher privilege level misuse if those files contain credentials or configuration data. The weakness is a classic path traversal issue identified as CWE-22.
Affected Systems
Affected products are Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller and Schneider Electric Saitel DP Remote Terminal Unit & Controller. Version information is not supplied in the advisory, so system administrators should verify the firmware or software revision against the vendor’s release notes to determine if the devices contain the affected code.
Risk and Exploitability
With a CVSS score of 7.1 the vulnerability is considered high severity, but the EPSS score is currently unavailable, suggesting no known widespread exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog, indicating it has not been observed in malicious exploitation yet. The likely attack vector is remote access over the network, inferred from the description that user-supplied input is processed server‑side; an attacker would need to supply a crafted pathname typically through an exposed interface to trigger the file read.
