Security1 publisher2 min readPublished
Schneider tells SCADAPack operators to migrate off Secure Lock after a credential exposure finding
Abhinav Agarwal's report of insufficiently protected credentials covers every version of seven SCADAPack families. Schneider's answer is role-based access control on the 47x line plus network segmentation and the RTU firewall service.
The Watch · Security desk
What happened
- CISA advisory ICSA-26-258-04 records an insufficiently protected credentials flaw, CVE-2026-81861, tied to the Secure Lock feature on Schneider Electric's SCADAPack remote terminal units.
- Seven product lines are listed as affected at every version: SCADAPack 47x, 47xi, 47xd, 470R, 57x, 3xx and 32.
- Abhinav Agarwal reported the flaw to CISA, and Schneider published the same finding as its own advisory SEVD-2026-251-03.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint There is no firmware to stage in a maintenance window, so the response is device configuration and network design, done per unit by the people who own the control network.
- exposure Any site that keeps Secure Lock enabled to satisfy a legacy system keeps the credential exposure for as long as the feature stays in use, on Schneider's own reading of the feature.
- cost The sweep covers every unit in those seven families whatever firmware it runs, so the labour scales with fleet size and no version filter shrinks the list.
CWE-522 is the class Schneider filed under: credentials that are insufficiently protected [2]. The stated result is exposure of authentication information and unauthorized access to RTU functionality, and, through Secure Lock specifically, unauthorized access to the RTU configuration with a loss of confidentiality [8][4]. CISA did not publish a CVSS score for CVE-2026-81861, and the advisory does not describe how the credentials are exposed [15]. Exploitability turns on reachability: whoever can talk to the device's services is the population at risk.
Every affected line is listed at vers:all/* [3]. Seven families, all versions [9]. The remediation section is configuration guidance: role-based access control, network segmentation, the RTU firewall service, and the hardening and secured communication sections of the SCADAPack Cybersecurity Guide [5].
RBAC is named as the recommended access control mechanism for SCADAPack 47x devices and as the feature to use in place of Secure Lock [6]. Secure Lock is described in the same block as "legacy functionality retained for backward compatibility with existing deployments" that "should only be used where required to support legacy system requirements" [10]. For a deployment that still needs it, the guidance is to keep using it where required [10].
The affected list runs wider than the advisory's title. SCADAPack 3xx and SCADAPack 32 appear under the same CVE, while the summary identifies the 47x, 47xi, 47xd, 470R and 57x as the remote terminal units providing remote monitoring and control [11][3]. The RBAC instruction is scoped to 47x devices in the text [6]. The other mitigation block states segmentation between trusted and untrusted networks and implementation of the RTU Firewall Service to restrict unauthorized access to device services, without a model qualifier [12].
Enabling that firewall changes which services answer on the wire. On a live polled link, that is a change to test [12].
Deployment is worldwide, in Critical Manufacturing and Energy, and Schneider is headquartered in France [13]. Abhinav Agarwal reported the vulnerability to CISA [7]. Schneider published the same finding as SEVD-2026-251-03 [14].
What to watch
- A firmware release, or documentation showing RBAC available on SCADAPack 3xx and 32, would move this from configuration work to a patch cycle.
- CVSS metrics or a technical writeup from Abhinav Agarwal would settle whether Secure Lock credentials come off the device over the network or only with local access.
- A KEV listing or a reported intrusion through Secure Lock would change the priority for energy and manufacturing asset owners.