The vulnerability is an incorrect permission assignment flaw that allows a local attacker with privileged access to read system files containing password hashes. This could enable the attacker to compromise user accounts by leveraging the exposed credentials. The weakness stems from improper file permissions, classed as CWE-732, and results in a breach of confidentiality and potential further compromise of system integrity.

Schneider Electric EasyLogic T150 (formerly Saitel DR) Remote Terminal Unit & Controller and Schneider Electric Saitel DP Remote Terminal Unit & Controller are impacted. Version information was not provided in the advisory, so all releases of these products may be affected until an official patch is released.

The CVSS score of 6.7 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, so there is no known widespread exploitation yet. The likely attack vector is a local privileged user who can access the system files; this could occur via an insider threat, compromised local device, or after an initial exploitation that grants local privileges.