download.schneider-electric.com
https://download.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf CVE-2024-8938
CRITICAL
Record summary
CVE-2024-8938 has a selected CVSS score of 9.2 (critical).
Description
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in memory size computation.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Nov 13, 2024 · Source: CVE List
Affected products and versions
6| Product | Source | Version range | Status |
|---|---|---|---|
Modicon M340 CPU (part numbers BMXP34*)Browse Schneider Electric / Modicon M340 CPU (part numbers BMXP34*)Default status: unaffected | CVE List | Versions prior to SV3.65 | affected |
Modicon MC80 (part numbers BMKC80)Browse Schneider Electric / Modicon MC80 (part numbers BMKC80)Default status: unaffected | CVE List | All versions | affected |
Modicon Momentum Unity M1E Processor (171CBU*)Browse Schneider Electric / Modicon Momentum Unity M1E Processor (171CBU*)Default status: unaffected | CVE List | All Versions | affected |
modicon_m340Browse schneider-electric / modicon_m340Default status: unaffected | CVE List | Before SV3.65 | affected |
modicon_mc80Browse schneider-electric / modicon_mc80Default status: unknown | CVE List | Before * | affected |
modicon_momentum_unity_m1e_processorBrowse schneider-electric / modicon_momentum_unity_m1e_processorDefault status: unknown | CVE List | Before * | affected |
References
2nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2024-8938