by Kastro
Paper/Archive/CVE-2024-2051

CVE-2024-2051

Schneider Electric Easergy T200 (Modbus) Models: T200I, T200E, T200P, T200S, T200H — CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorize…

EPSS 0.8%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 55.1.551 × 2011.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized access to the system when an attacker conducts brute-force attacks against the login form.

Affected

ProductAffectedFixed inSource
Easergy T200 (Modbus) Models: T200I, T200E, T200P, T200S, T200HSC2-04MOD-07000104 – prior–CNA
Easergy T200 (IEC104) Models: T200I, T200E, T200P, T200S, T200HSC2-04IEC-07000104 – prior–CNA
Easergy T200 (DNP3) Models: T200I, T200E, T200P, T200S, T200HSC2-04DNP-07000104 – prior–CNA
easergy_t200i_firmware< sc2-04mod-07000104sc2-04mod-07000104CISA-ADP
easergy_t200e_firmware< sc2-04mod-07000104sc2-04mod-07000104CISA-ADP
easergy_t200p_firmware< sc2-04mod-07000104sc2-04mod-07000104CISA-ADP
easergy_t200s_firmware< sc2-04mod-07000104sc2-04mod-07000104CISA-ADP
easergy_t200h_firmware< sc2-04mod-07000104sc2-04mod-07000104CISA-ADP

Scores by source

schneider (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refdownload.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-072-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-072-01.pdf