Medium severity · published Jun 12, 2024
CVE-2024-5056
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver…
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may
prevent user to update the device firmware and prevent proper behavior of the webserver when
specific files or directories are removed from the filesystem.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Modicon M340 · Schneider Electric
All versions · source: vendor
NM
Network module, Modicon M340, Ethernet TCP/IP BMXNOE0110 · Schneider Electric
All Versions · source: vendor
NM
Network module, Modicon M340, Modbus/TCP BMXNOE0100 · Schneider Electric
All versions · source: vendor
BF
Bmxnoe0100 Firmware · Schneider-electric
All versions, or not specified · source: NVD
BF
Bmxnoe0110 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicon M340 Firmware · Schneider-electric
All versions, or not specified · source: NVD
MM
Modicom M340 · Schneider-electric
0 · source: CISA
MM
Modicom M340 Firmware · Schneider-electric
0 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-5056
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-5056
Vendor Advisory
https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-01.pdf
More from Modicon M340
8.1
CVE-2024-8938
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful…
7.5
CVE-2025-6625
CWE-20: Improper Input Validation vulnerability exists that could cause a Denial Of Service when specific crafted FTP command is sent to the device
7.5
CVE-2024-8933
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead…
–
CVE-2013-2761
The Schneider Electric M340 BMXNOE01xx and BMXP3420xx PLC modules allow remote authenticated users to cause a denial of service (module crash) via crafted FTP traffic, as…
–
CVE-2013-0664
The FactoryCast service on the Schneider Electric Quantum 140NOE77111 and 140NWM10000, M340 BMXNOE0110x, and Premium TSXETY5103 PLC modules allows remote authenticated users to…