8.1

CVE-2024-37040

CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability
exists that could allow a user with access to the device’s web interface to cause a fault on the
device when sending a malformed HTTP request.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Schneider-electric ≫ Sage Rtu Firmware Version < c3414-500-s02k5_p9
   Schneider-electric ≫ Sage 1410 Version-
   Schneider-electric ≫ Sage 1430 Version-
   Schneider-electric ≫ Sage 1450 Version-
   Schneider-electric ≫ Sage 2400 Version-
   Schneider-electric ≫ Sage 3030 Magnum Version-
   Schneider-electric ≫ Sage 4400 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.44
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
cybersecurity@se.com 5.4 2.8 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.