Lucene search

K
vulnrichmentSchneiderVULNRICHMENT:CVE-2024-37038
HistoryJun 12, 2024 - 4:51 p.m.

CVE-2024-37038

2024-06-1216:51:55
CWE-276
schneider
github.com
1
vulnerability
device
web interface
unauthorized uploads
file
firmware
custom web requests

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated
user with access to the device’s web interface to perform unauthorized file and firmware
uploads when crafting custom web requests.

ADP Affected

[
  {
    "cpes": [
      "cpe:2.3:h:schneider_electric:sage_4400:*:*:*:*:*:*:*:*"
    ],
    "vendor": "schneider_electric",
    "product": "sage_4400",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "c3414-500-s02k5_p8"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:h:schneider_electric:sage_1430:*:*:*:*:*:*:*:*"
    ],
    "vendor": "schneider_electric",
    "product": "sage_1430",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "c3414-500-s02k5_p8"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:h:schneider_electric:sage_2400:*:*:*:*:*:*:*:*"
    ],
    "vendor": "schneider_electric",
    "product": "sage_2400",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "c3414-500-s02k5_p8"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:h:schneider_electric:sage_3030m:*:*:*:*:*:*:*:*"
    ],
    "vendor": "schneider_electric",
    "product": "sage_3030m",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "c3414-500-s02k5_p8"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:h:schneider_electric:sage_1410:*:*:*:*:*:*:*:*"
    ],
    "vendor": "schneider_electric",
    "product": "sage_1410",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "c3414-500-s02k5_p8"
      }
    ],
    "defaultStatus": "unaffected"
  },
  {
    "cpes": [
      "cpe:2.3:h:schneider_electric:sage_1450:*:*:*:*:*:*:*:*"
    ],
    "vendor": "schneider_electric",
    "product": "sage_1450",
    "versions": [
      {
        "status": "affected",
        "version": "0",
        "versionType": "custom",
        "lessThanOrEqual": "c3414-500-s02k5_p8"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

6.9

Confidence

Low

SSVC

Exploitation

none

Automatable

no

Technical Impact

total

Related for VULNRICHMENT:CVE-2024-37038