by Kastro
Paper/Archive/CVE-2024-10575

CVE-2024-10575

Schneider Electric EcoStruxure IT Gateway — CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impa…

EPSS 0.6%CVSS 10.0
critical.is priorityof 100
40
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 51.0.510 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CWE-862: Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devices.

Affected

ProductAffectedFixed inSource
EcoStruxure IT GatewayVersion 1.21.0.6–CNA
EcoStruxure IT GatewayVersion 1.22.0.3–CNA
EcoStruxure IT GatewayVersion 1.22.1.5–CNA
EcoStruxure IT GatewayVersion 1.23.0.4–CNA
ecostruxure_it_gateway1.21.0.6–CISA-ADP
ecostruxure_it_gateway1.22.0.3–CISA-ADP
ecostruxure_it_gateway1.22.1.5–CISA-ADP
ecostruxure_it_gateway1.23.0.4–CISA-ADP

Scores by source

schneider (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:L/SA:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
schneider (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdownload.schneider-electric.com/doc/SEVD-2024-317-04/SEVD-2024-317-04.pdf