CVE-2024-0400 Vulnerability Details

  /     /     /  

CVE-2024-0400 Metadata Quick Info

CVE Published: 27/03/2024 | CVE Updated: 06/08/2024 | CVE Year: 2024
Source: Hitachi Energy | Vendor: Hitachi Energy | Product: MACH SCM
Status : PUBLISHED

---

CVE-2024-0400 Description

SCM Software is a client and server application. An Authenticated System manager client can execute LINQ query in the SCM server, for customized filtering. An Authenticated malicious client can send a specially crafted code to skip the validation and execute arbitrary code (RCE) on the SCM Server remotely. Malicious clients can execute any command by using this RCE vulnerability.

Metrics

CVSS Version: 3.1 | Base Score: 7.5 HIGH
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

l➤ Exploitability Metrics:
    Attack Vector (AV)* NETWORK
    Attack Complexity (AC)* HIGH
    Privileges Required (PR)* LOW
    User Interaction (UI)* NONE
    Scope (S)* UNCHANGED

l➤ Impact Metrics:
    Confidentiality Impact (C)* HIGH
    Integrity Impact (I)* HIGH
    Availability Impact (A)* HIGH

Weakness Enumeration (CWE)

CWE-ID: CWE-94
CWE Name: CWE-94 Improper Control of Generation of Code ( Code Injection )
Source: Hitachi Energy

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID: CAPEC-551
CAPEC Description: CAPEC-551 Modify Existing Service


Source: NVD (National Vulnerability Database).