download.schneider-electric.com
https://download.schneider-electric.com/doc/SEVD-2024-317-02/SEVD-2024-317-02.pdf CVE-2024-8933
HIGH
Record summary
CVE-2024-8933 has a selected CVSS score of 7.5 (high).
Description
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 13, 2024 · Source: CVE List
Affected products and versions
6| Product | Source | Version range | Status |
|---|---|---|---|
Modicon M340 CPU (part numbers BMXP34*)Browse Schneider Electric / Modicon M340 CPU (part numbers BMXP34*)Default status: unaffected | CVE List | All versions | affected |
Modicon MC80 (part numbers BMKC80)Browse Schneider Electric / Modicon MC80 (part numbers BMKC80)Default status: unaffected | CVE List | All versions | affected |
Modicon Momentum Unity M1E Processor (171CBU*)Browse Schneider Electric / Modicon Momentum Unity M1E Processor (171CBU*)Default status: unaffected | CVE List | All Versions | affected |
modicon_m340Browse schneider-electric / modicon_m340Default status: unknown | CVE List | Before * | affected |
modicon_mc80Browse schneider-electric / modicon_mc80Default status: unknown | CVE List | Before * | affected |
modicon_momentum_unity_m1e_processorBrowse schneider-electric / modicon_momentum_unity_m1e_processorDefault status: unknown | CVE List | Before * | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-8933