8.8

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated
user with access to the device’s web interface to perform unauthorized file and firmware
uploads when crafting custom web requests.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Schneider-electric ≫ Sage Rtu Firmware Version < c3414-500-s02k5_p9
   Schneider-electric ≫ Sage 1410 Version -
   Schneider-electric ≫ Sage 1430 Version -
   Schneider-electric ≫ Sage 1450 Version -
   Schneider-electric ≫ Sage 2400 Version -
   Schneider-electric ≫ Sage 3030 Magnum Version -
   Schneider-electric ≫ Sage 4400 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.37% 0.289
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SE.com 7.5 1.6 5.9
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdf
Patch
Vendor Advisory