CVE-2024-8933
- State
- Published
- Severity
- 7.5 High
- Published
- Nov 13, 2024
- Updated
- Nov 13, 2024
- Reserved
- Sep 17, 2024
Description
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.5 High | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | schneider |
| 3.1 | 7.5 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | schneider |
Weaknesses
- CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Affected Products
| Product | Versions |
|---|---|
Modicon M340 CPU (part numbers BMXP34*)Schneider Electric |
|
Modicon MC80 (part numbers BMKC80)Schneider Electric |
|
Modicon Momentum Unity M1E Processor (171CBU*)Schneider Electric |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.