SAUTER Building Controller RCE Flaw (CVE-2026-78319) Disclosed

Executive Summary

A critical remote code execution (RCE) vulnerability, tracked as CVE-2026-78319, has been disclosed in building automation controllers from the manufacturer SAUTER. The flaw carries a CVSS score of 9.8, indicating its extreme severity. An unauthenticated remote attacker could exploit this vulnerability to achieve full control over affected devices, which are responsible for managing critical building systems like heating, ventilation, and air conditioning (HVAC). A successful attack could lead to physical disruption, equipment damage, and unsafe environmental conditions. SAUTER has released firmware updates to address the issue, and asset owners are urged to patch immediately.

Vulnerability Details

The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition, cataloged as CWE-367. It exists in the firmware update mechanism of the affected controllers. An attacker can exploit this by sending a legitimate firmware update request and then, in the small window of time between the device checking the file and actually using it, replacing the legitimate file with a malicious one. This tricks the device into accepting and executing the attacker's arbitrary code, leading to a full compromise of the controller.

The flaw was discovered by researchers during the Cyberdefence Campus Domotics Hackathon 2026 and was disclosed responsibly via CERT@VDE.

Affected Systems

The vulnerability impacts the following SAUTER products and firmware versions:

• modulo 6 firmware: versions below 4.0.0
• EY-modulo 5 firmware: versions below 7.0.0

Specific affected hardware models include:

• ecos504
• ecos505
• modu612-LC
• modu660-AS
• modu680-AS

Exploitation Status

As of the public disclosure on September 1, 2026, there have been no reports of a public proof-of-concept (PoC) exploit or any signs of active in-the-wild exploitation. However, given the critical nature of the flaw and its direct impact on physical systems, the likelihood of future exploitation is high.

Impact Assessment

Exploitation of CVE-2026-78319 could have severe real-world consequences. An attacker with control over a building automation controller could:

• Disrupt Building Operations: Shut down HVAC systems, leading to unsafe temperatures in sensitive environments like data centers, hospitals, or manufacturing facilities.
• Cause Physical Damage: Manipulate systems to cause equipment to operate outside of safe parameters, potentially leading to physical damage and costly repairs.
• Compromise Safety: Disable safety-critical systems or create hazardous conditions within a building.
• Gain a Foothold: Use the compromised controller as a pivot point to attack other systems on the operational technology (OT) or corporate network.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Asset Inventory: Use network scanning and asset inventory tools to identify all SAUTER controllers on the network and their firmware versions to determine if they are vulnerable.
• Network Monitoring: Implement network intrusion detection systems (NIDS) with signatures that can detect attempts to exploit TOCTOU vulnerabilities or anomalous traffic patterns directed at the controllers' update services. This is an application of D3FEND's Network Traffic Analysis (D3-NTA).
• Configuration Auditing: Regularly audit the configuration of controllers to detect any unauthorized changes.

Remediation Steps

• Apply Firmware Updates: The primary remediation is to update all affected devices to the patched firmware versions: modulo 6 version 4.0.0 or newer and EY-modulo 5 version 7.0.0 or newer. This is a direct implementation of D3FEND's Software Update (D3-SU).
• Enable Downgrade Protection: After updating, SAUTER recommends enabling downgrade protection to prevent an attacker from rolling back the firmware to a vulnerable version.
• Network Segmentation: As a critical best practice for OT security, ensure that building automation controllers are on a segmented network, isolated from the corporate IT network and the public internet. Access should be strictly controlled via firewalls. This aligns with D3FEND's Network Isolation (D3-NI).