CVE-2024-12142: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page…

Description

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists that could cause information disclosure of restricted web page, modification of web page and denial of service when specific web pages are modified and restricted functions are invoked.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 30% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

BM

BMXNOE0100 · Schneider Electric

All versions · source: vendor

BM

BMXNOE0110 · Schneider Electric

All Versions · source: vendor

BM

BMXNOR0200H · Schneider Electric

Versions prior to SV1.70IR26 · source: vendor

MM

Modicon M340 processors (part numbers BMXP34*) · Schneider Electric

All versions · source: vendor