download.schneider-electric.com
https://download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf CVE-2024-8937
HIGH
Record summary
CVE-2024-8937 has a selected CVSS score of 8.3 (high).
Description
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in the authentication process.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 13, 2024 · Source: CVE List
Affected products and versions
3| Product | Source | Version range | Status |
|---|---|---|---|
Modicon M340 CPU (part numbers BMXP34*)Browse Schneider Electric / Modicon M340 CPU (part numbers BMXP34*)Default status: unaffected | CVE List | Versions prior to SV3.65 | affected |
Modicon MC80 (part numbers BMKC80)Browse Schneider Electric / Modicon MC80 (part numbers BMKC80)Default status: unaffected | CVE List | All versions | affected |
Modicon Momentum Unity M1E Processor (171CBU*)Browse Schneider Electric / Modicon Momentum Unity M1E Processor (171CBU*)Default status: unaffected | CVE List | All Versions | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-8937