High severity · published Nov 13, 2024
CVE-2024-8933
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead…
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of
confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the
logical network while a valid user uploads or downloads a project file into the controller.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MM
Modicon M340 CPU (part numbers BMXP34*) · Schneider Electric
All versions · source: vendor
MM
Modicon MC80 (part numbers BMKC80) · Schneider Electric
All versions · source: vendor
MM
Modicon Momentum Unity M1E Processor (171CBU*) · Schneider Electric
All Versions · source: vendor
MM
Modicon M340 · Schneider-electric
0 · source: CISA
MM
Modicon Mc80 · Schneider-electric
0 · source: CISA
MM
Modicon Momentum Unity M1e Processor · Schneider-electric
0 · source: CISA
Affected product
MM
Modicon M340 CPU (part numbers BMXP34*)
Schneider Electric
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8933
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8933
download.schneider-electric.com
https://download.schneider-electric.com/doc/SEVD-2024-317-02/SEVD-2024-317-02.pdf
More from Modicon M340 CPU (part numbers BMXP34*)
8.1
CVE-2024-8938
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful…
8.1
CVE-2023-6408
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause a denial of service and loss of…
7.5
CVE-2024-8935
CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers when conducting a…
6.5
CVE-2024-8936
CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle attack followed by…
6.5
CVE-2024-8937
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful…