CVE-2024-8933 Vulnerability Details

  /     /     /  

CVE-2024-8933 Metadata Quick Info

CVE Published: 13/11/2024 | CVE Updated: 13/11/2024 | CVE Year: 2024
Source: schneider | Vendor: Schneider Electric | Product: Modicon M340 CPU (part numbers BMXP34*)
Status : PUBLISHED

---

CVE-2024-8933 Description

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.

Metrics

CVSS Version: 3.1 | Base Score: n/a
Vector: n/a

l➤ Exploitability Metrics:
    Attack Vector (AV)*
    Attack Complexity (AC)*
    Privileges Required (PR)*
    User Interaction (UI)*
    Scope (S)*

l➤ Impact Metrics:
    Confidentiality Impact (C)*
    Integrity Impact (I)*
    Availability Impact (A)*

Weakness Enumeration (CWE)

CWE-ID: CWE-924
CWE Name: CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel
Source: Schneider Electric

Common Attack Pattern Enumeration and Classification (CAPEC)

CAPEC-ID:
CAPEC Description:


Source: NVD (National Vulnerability Database).