Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CERTFR-2024-AVI-0476
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Schneider Electric. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Schneider Electric | Sage 2400 | Sage 2400 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 toutes versions | ||
| Schneider Electric | Sage 1450 | Sage 1450 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Sage 1430 | Sage 1430 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Sage 3030 Magnum | Sage 3030 Magnum avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | Sage 1410 | Sage 1410 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | EVlink Home Smart | EVlink Home Smart versions 2.0.4.1.2_131 et 2.0.3.8.2_128 antérieures à 2.0.5.0.0_134 | ||
| Schneider Electric | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 | Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 | ||
| Schneider Electric | Modicon M340 | Modicon M340 toutes versions | ||
| Schneider Electric | PowerLogic P5 | PowerLogic P5 versions antérieures à 02.501.101 | ||
| Schneider Electric | Sage 4400 | Sage 4400 avec un microgiciel antérieur à C3414-500-S02K5_P9 | ||
| Schneider Electric | N/A | SpaceLogic AS-P et SpaceLogic AS-B versions antérieures à 6.0.1 ou versions 5.0.3 et 4.0.5 sans le dernier correctif de sécurité | ||
| Schneider Electric | Network module, Modicon M340, Modbus/TCP BMXNOE0100 | Network module, Modicon M340 et Modbus/TCP BMXNOE0100 toutes versions |
References
| Title | Publication Time | Tags | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Sage 2400 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 2400",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110 toutes versions",
"product": {
"name": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 1450 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 1450",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 1430 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 1430",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 3030 Magnum avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 3030 Magnum",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 1410 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 1410",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "EVlink Home Smart versions 2.0.4.1.2_131 et 2.0.3.8.2_128 ant\u00e9rieures \u00e0 2.0.5.0.0_134",
"product": {
"name": "EVlink Home Smart",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110",
"product": {
"name": "Network module, Modicon M340 et Ethernet TCP/IP BMXNOE0110",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Modicon M340 toutes versions",
"product": {
"name": "Modicon M340",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "PowerLogic P5 versions ant\u00e9rieures \u00e0 02.501.101",
"product": {
"name": "PowerLogic P5",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Sage 4400 avec un microgiciel ant\u00e9rieur \u00e0 C3414-500-S02K5_P9",
"product": {
"name": "Sage 4400",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "SpaceLogic AS-P et SpaceLogic AS-B versions ant\u00e9rieures \u00e0 6.0.1 ou versions 5.0.3 et 4.0.5 sans le dernier correctif de s\u00e9curit\u00e9",
"product": {
"name": "N/A",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
},
{
"description": "Network module, Modicon M340 et Modbus/TCP BMXNOE0100 toutes versions",
"product": {
"name": "Network module, Modicon M340, Modbus/TCP BMXNOE0100",
"vendor": {
"name": "Schneider Electric",
"scada": true
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-5557",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5557"
},
{
"name": "CVE-2024-37039",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37039"
},
{
"name": "CVE-2024-5558",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5558"
},
{
"name": "CVE-2024-5056",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5056"
},
{
"name": "CVE-2024-37037",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37037"
},
{
"name": "CVE-2024-5559",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5559"
},
{
"name": "CVE-2024-5313",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5313"
},
{
"name": "CVE-2024-37038",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37038"
},
{
"name": "CVE-2024-37040",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37040"
},
{
"name": "CVE-2024-5560",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-5560"
},
{
"name": "CVE-2024-37036",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-37036"
}
],
"initial_release_date": "2024-06-11T00:00:00",
"last_revision_date": "2024-06-14T00:00:00",
"links": [],
"reference": "CERTFR-2024-AVI-0476",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2024-06-11T00:00:00.000000"
},
{
"description": "Ajout des identifiants CVE.",
"revision_date": "2024-06-14T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Schneider Electric. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Schneider Electric",
"vendor_advisories": [
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-02",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-02.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-01",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-01.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-03",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-03.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-05",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
},
{
"published_at": "2024-06-11",
"title": "Bulletin de s\u00e9curit\u00e9 Schneider Electric SEVD-2024-163-04",
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-04.pdf"
}
]
}
CVE-2024-5559 (GCVE-0-2024-5559)
Vulnerability from cvelistv5
Published
2024-06-12 17:18
Modified
2024-08-01 21:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Summary
CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could
cause denial of service, device reboot, or an attacker gaining full control of the relay when a
specially crafted reset token is entered into the front panel of the device.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Schneider Electric | PowerLogic P5 |
Version: v01.500.104 and prior |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5559",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-01T20:49:53.165251Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-01T21:26:14.765Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.557Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-02.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "PowerLogic P5",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "v01.500.104 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nCWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could\ncause denial of service, device reboot, or an attacker gaining full control of the relay when a\nspecially crafted reset token is entered into the front panel of the device.\n\n\n"
}
],
"value": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could\ncause denial of service, device reboot, or an attacker gaining full control of the relay when a\nspecially crafted reset token is entered into the front panel of the device."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T17:18:04.604Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-02\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-02.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-5559",
"datePublished": "2024-06-12T17:18:04.604Z",
"dateReserved": "2024-05-31T06:58:51.639Z",
"dateUpdated": "2024-08-01T21:18:06.557Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5558 (GCVE-0-2024-5558)
Vulnerability from cvelistv5
Published
2024-06-12 16:26
Modified
2024-08-01 21:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Summary
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could
cause escalation of privileges when an attacker abuses a limited admin account.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | SpaceLogic AS-P |
Version: V5.0.3 and prior |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider-electric:spacelogic_as-b:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "spacelogic_as-b",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "5.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider-electric:spacelogic_as-p:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "spacelogic_as-p",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "5.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5558",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T18:07:10.554620Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-23T16:20:36.411Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.335Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-04.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SpaceLogic AS-P",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V5.0.3 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SpaceLogic AS-B",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V5.0.3 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nCWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could\ncause escalation of privileges when an attacker abuses a limited admin account.\n\n"
}
],
"value": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability exists that could\ncause escalation of privileges when an attacker abuses a limited admin account."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:26:26.294Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-04.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-5558",
"datePublished": "2024-06-12T16:26:26.294Z",
"dateReserved": "2024-05-31T06:58:47.453Z",
"dateUpdated": "2024-08-01T21:18:06.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5056 (GCVE-0-2024-5056)
Vulnerability from cvelistv5
Published
2024-06-12 12:10
Modified
2024-08-01 21:03
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-552 - Files or Directories Accessible to External Parties
Summary
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may
prevent user to update the device firmware and prevent proper behavior of the webserver when
specific files or directories are removed from the filesystem.
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | Modicon M340 |
Version: All versions |
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:schneider-electric:modicom_m340_firmware:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "modicom_m340_firmware",
"vendor": "schneider-electric",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider-electric:modicom_m340:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "modicom_m340",
"vendor": "schneider-electric",
"versions": [
{
"lessThan": "*",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5056",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T14:14:02.243238Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T14:17:06.480Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:03:10.683Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-01.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Modicon M340",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network module, Modicon M340, Modbus/TCP BMXNOE0100",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Network module, Modicon M340, Ethernet TCP/IP BMXNOE0110",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "All Versions"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nCWE-552: Files or Directories Accessible to External Parties vulnerability exists which may\nprevent user to update the device firmware and prevent proper behavior of the webserver when\nspecific files or directories are removed from the filesystem.\n\n"
}
],
"value": "CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may\nprevent user to update the device firmware and prevent proper behavior of the webserver when\nspecific files or directories are removed from the filesystem."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552 Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T12:10:43.250Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-01.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-5056",
"datePublished": "2024-06-12T12:10:43.250Z",
"dateReserved": "2024-05-17T10:06:08.565Z",
"dateUpdated": "2024-08-01T21:03:10.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37039 (GCVE-0-2024-37039)
Vulnerability from cvelistv5
Published
2024-06-12 16:54
Modified
2024-08-02 03:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-252 - Unchecked Return Value
Summary
CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the
device when an attacker sends a specially crafted HTTP request.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | Sage 1410 |
Version: Versions C3414-500-S02K5_P8 and prior |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_4400",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37039",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T18:24:08.466465Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T18:33:50.964Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.886Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\n\n\n\n\nCWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the\ndevice when an attacker sends a specially crafted HTTP request.\n\n\n\n\n\n\n\n\n\n"
}
],
"value": "CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the\ndevice when an attacker sends a specially crafted HTTP request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-252",
"description": "CWE-252 Unchecked Return Value",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:54:23.117Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-37039",
"datePublished": "2024-06-12T16:54:23.117Z",
"dateReserved": "2024-05-31T06:52:05.762Z",
"dateUpdated": "2024-08-02T03:43:50.886Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37037 (GCVE-0-2024-37037)
Vulnerability from cvelistv5
Published
2024-06-12 16:50
Modified
2024-08-02 03:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path
Traversal’) vulnerability exists that could allow an authenticated user with access to the device’s
web interface to corrupt files and impact device functionality when sending a crafted HTTP
request.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | Sage 1410 |
Version: Versions C3414-500-S02K5_P8 and prior |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_4400",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37037",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T18:28:51.967522Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T18:33:38.098Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.902Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\nCWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u2018Path\nTraversal\u2019) vulnerability exists that could allow an authenticated user with access to the device\u2019s\nweb interface to corrupt files and impact device functionality when sending a crafted HTTP\nrequest.\n\n\n\n\n\n"
}
],
"value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u2018Path\nTraversal\u2019) vulnerability exists that could allow an authenticated user with access to the device\u2019s\nweb interface to corrupt files and impact device functionality when sending a crafted HTTP\nrequest."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:50:09.159Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-37037",
"datePublished": "2024-06-12T16:50:09.159Z",
"dateReserved": "2024-05-31T06:52:05.762Z",
"dateUpdated": "2024-08-02T03:43:50.902Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37038 (GCVE-0-2024-37038)
Vulnerability from cvelistv5
Published
2024-06-12 16:51
Modified
2024-08-02 03:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-276 - Incorrect Default Permissions
Summary
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated
user with access to the device’s web interface to perform unauthorized file and firmware
uploads when crafting custom web requests.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | Sage 1410 |
Version: Versions C3414-500-S02K5_P8 and prior |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider_electric:sage_4400:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_4400",
"vendor": "schneider_electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider_electric:sage_1430:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_1430",
"vendor": "schneider_electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider_electric:sage_2400:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_2400",
"vendor": "schneider_electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider_electric:sage_3030m:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_3030m",
"vendor": "schneider_electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider_electric:sage_1410:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_1410",
"vendor": "schneider_electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider_electric:sage_1450:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_1450",
"vendor": "schneider_electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37038",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T17:44:53.062764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T17:54:11.618Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.738Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\n\n\nCWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\nuser with access to the device\u2019s web interface to perform unauthorized file and firmware\nuploads when crafting custom web requests.\n\n\n\n\n\n\n\n"
}
],
"value": "CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\nuser with access to the device\u2019s web interface to perform unauthorized file and firmware\nuploads when crafting custom web requests."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:51:55.800Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-37038",
"datePublished": "2024-06-12T16:51:55.800Z",
"dateReserved": "2024-05-31T06:52:05.762Z",
"dateUpdated": "2024-08-02T03:43:50.738Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37036 (GCVE-0-2024-37036)
Vulnerability from cvelistv5
Published
2024-06-12 16:48
Modified
2024-08-02 03:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-787 - Out-of-bounds Write
Summary
CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass
when sending a malformed POST request and particular configuration parameters are set.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | Sage 1410 |
Version: Versions C3414-500-S02K5_P8 and prior |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:schneider_electric:sage_1410_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:schneider_electric:sage_1430_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:schneider_electric:sage_1450_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:schneider_electric:sage_2400_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:schneider_electric:sage_3030_magnum_firmware:*:*:*:*:*:*:*:*",
"cpe:2.3:o:schneider_electric:sage_4400_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "sage_4400_firmware",
"vendor": "schneider_electric",
"versions": [
{
"lessThanOrEqual": "C3414-500-S02K5_P8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37036",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T17:43:17.841310Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T17:57:45.916Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.996Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\nCWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass\nwhen sending a malformed POST request and particular configuration parameters are set.\n\n\n\n"
}
],
"value": "CWE-787: Out-of-bounds Write vulnerability exists that could result in an authentication bypass\nwhen sending a malformed POST request and particular configuration parameters are set."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:48:09.163Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-37036",
"datePublished": "2024-06-12T16:48:09.163Z",
"dateReserved": "2024-05-31T06:52:05.762Z",
"dateUpdated": "2024-08-02T03:43:50.996Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37040 (GCVE-0-2024-37040)
Vulnerability from cvelistv5
Published
2024-06-12 16:56
Modified
2024-08-02 03:43
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Summary
CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | Sage 1410 |
Version: Versions C3414-500-S02K5_P8 and prior |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_4400",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37040",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T18:27:09.666436Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T18:34:05.093Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:43:50.968Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\n\n\n\n\n\n\n\n\n\nCWE-120: Buffer Copy without Checking Size of Input (\u2018Classic Buffer Overflow\u2019) vulnerability\nexists that could allow a user with access to the device\u2019s web interface to cause a fault on the\ndevice when sending a malformed HTTP request.\n\n\n\n\n\n\n\n\n\n\n\n"
}
],
"value": "CWE-120: Buffer Copy without Checking Size of Input (\u2018Classic Buffer Overflow\u2019) vulnerability\nexists that could allow a user with access to the device\u2019s web interface to cause a fault on the\ndevice when sending a malformed HTTP request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:56:06.117Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-37040",
"datePublished": "2024-06-12T16:56:06.117Z",
"dateReserved": "2024-05-31T06:52:05.762Z",
"dateUpdated": "2024-08-02T03:43:50.968Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5313 (GCVE-0-2024-5313)
Vulnerability from cvelistv5
Published
2024-06-12 12:14
Modified
2024-08-01 21:11
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-668 - Exposure of Resource to Wrong Sphere
Summary
CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH
interface over the product network interface. This does not allow to directly exploit the product or
make any unintended operation as the SSH interface access is protected by an authentication
mechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts
to perform a potential denial of service attack on the exposed SSH interface.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Schneider Electric | EVlink Home Smart |
Version: v2.0.4.1.2_131 Version: v2.0.3.8.2_128 |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:schneider-electric:evlink_home_smart:2.0.4.1.2_131:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "evlink_home_smart",
"vendor": "schneider-electric",
"versions": [
{
"status": "affected",
"version": "2.0.4.1.2_131"
},
{
"status": "affected",
"version": "2.0.3.8.2_128"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5313",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T14:57:54.307091Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T15:04:51.869Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:11:12.332Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-03.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EVlink Home Smart",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "v2.0.4.1.2_131"
},
{
"status": "affected",
"version": "v2.0.3.8.2_128"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nCWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH\ninterface over the product network interface. This does not allow to directly exploit the product or\nmake any unintended operation as the SSH interface access is protected by an authentication\nmechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts\nto perform a potential denial of service attack on the exposed SSH interface.\n\n"
}
],
"value": "CWE-668: Exposure of the Resource Wrong Sphere vulnerability exists that exposes a SSH\ninterface over the product network interface. This does not allow to directly exploit the product or\nmake any unintended operation as the SSH interface access is protected by an authentication\nmechanism. Impacts are limited to port scanning and fingerprinting activities as well as attempts\nto perform a potential denial of service attack on the exposed SSH interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-668",
"description": "CWE-668 Exposure of Resource to Wrong Sphere",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T12:14:58.979Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-03\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-03.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-5313",
"datePublished": "2024-06-12T12:14:58.979Z",
"dateReserved": "2024-05-24T08:29:40.058Z",
"dateUpdated": "2024-08-01T21:11:12.332Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5560 (GCVE-0-2024-5560)
Vulnerability from cvelistv5
Published
2024-06-12 16:45
Modified
2024-08-01 21:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds Read
Summary
CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the
device’s web interface when an attacker sends a specially crafted HTTP request.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | Sage 1410 |
Version: Versions C3414-500-S02K5_P8 and prior |
|||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*",
"cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "sage_4400",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "c3414-500-s02k5_p8",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T18:30:24.462387Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T18:32:10.472Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.538Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Sage 1410",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1430",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 1450",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 2400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 3030 Magnum",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Sage 4400",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "Versions C3414-500-S02K5_P8 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\nCWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the\ndevice\u2019s web interface when an attacker sends a specially crafted HTTP request.\n\n"
}
],
"value": "CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the\ndevice\u2019s web interface when an attacker sends a specially crafted HTTP request."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T16:45:56.256Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-5560",
"datePublished": "2024-06-12T16:45:56.256Z",
"dateReserved": "2024-05-31T06:58:55.638Z",
"dateUpdated": "2024-08-01T21:18:06.538Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-5557 (GCVE-0-2024-5557)
Vulnerability from cvelistv5
Published
2024-06-12 16:28
Modified
2024-08-01 21:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-532 - Insertion of Sensitive Information into Log File
Summary
CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause
exposure of SNMP credentials when an attacker has access to the controller logs.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Schneider Electric | SpaceLogic AS-P |
Version: V5.0.3 and prior |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:h:schneider-electric:spacelogic_as-b:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "spacelogic_as-b",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "5.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:h:schneider-electric:spacelogic_as-p:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "spacelogic_as-p",
"vendor": "schneider-electric",
"versions": [
{
"lessThanOrEqual": "5.0.3",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-5557",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-06-12T18:09:17.413313Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-06-12T18:09:28.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-01T21:18:06.830Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-04.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "SpaceLogic AS-P",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V5.0.3 and prior"
}
]
},
{
"defaultStatus": "unaffected",
"product": "SpaceLogic AS-B",
"vendor": "Schneider Electric",
"versions": [
{
"status": "affected",
"version": "V5.0.3 and prior"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause\nexposure of SNMP credentials when an attacker has access to the controller logs."
}
],
"value": "CWE-532: Insertion of Sensitive Information into Log File vulnerability exists that could cause\nexposure of SNMP credentials when an attacker has access to the controller logs."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-532",
"description": "CWE-532 Insertion of Sensitive Information into Log File",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-13T19:01:56.888Z",
"orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"shortName": "schneider"
},
"references": [
{
"url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-04\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-04.pdf"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
"assignerShortName": "schneider",
"cveId": "CVE-2024-5557",
"datePublished": "2024-06-12T16:28:56.844Z",
"dateReserved": "2024-05-31T06:58:40.277Z",
"dateUpdated": "2024-08-01T21:18:06.830Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…