CVE-2014-9206: Stack-based buffer overflow in Device Type Manager (DTM) 3.1.6 and earlier for Schneider Electric Invensys...

Security readout for executives and security teams

This is a local privilege-escalation flaw in Schneider Electric Invensys SRD Device Type Manager software. An attacker already able to use the affected system could use a malformed DLL file to gain higher privileges. The provided sources do not show remote exploitation, active exploitation, CVSS scoring, or detailed patch information. Exposure appears limited to environments running the affected SRD DTM software version 3.1.6 or earlier. This likely means engineering or maintenance workstations managing SRD 960 or 991 positioners, not broadly internet-facing systems. Confirm installed DTM versions before treating sites as affected. Treat this as a targeted operational technology workstation risk. It is not documented as remotely exploitable in the provided sources, but privilege escalation on engineering systems can materially increase impact after initial compromise. Mitigation focus: Inventory systems with SRD DTM installed and record exact versions.; Upgrade or replace DTM versions 3.1.6 and earlier using Schneider Electric guidance.; Restrict local access to engineering workstations running affected DTM software..

Prepared

Jun 13, 2026, 22:56 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.