This vulnerability is a CWE‑522 type credential exposure flaw that allows an attacker to obtain authentication information and gain unauthorized control of remote terminal unit (RTU) functions. The weakness arises when credentials are not sufficiently protected, potentially enabling an attacker to impersonate a legitimate user and manipulate RTU operations, which could compromise system integrity and safety.

The affected products are Schneider Electric SCADAPack 32, SCADAPack 3xx, SCADAPack 470R, SCADAPack 47x, SCADAPack 47xd, SCADAPack 47xi, and SCADAPack 57x. No specific version information is provided in the source data.

The CVSS score of 5.9 indicates moderate severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation. The likely attack path involves intercepting or otherwise acquiring the exposed credentials to authenticate with RTU services, but the exact attack vector is not specified in the description, so this is inferred rather than explicitly stated.