by Kastro
Paper/Archive/CVE-2024-8938

CVE-2024-8938

Schneider Electric Modicon M340 CPU (part numbers BMXP34*) — CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitr…

EPSS 0.5%CVSS 9.2
critical.is priorityof 100
37
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 45.0.450 × 209.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in memory size computation.

Affected

ProductAffectedFixed inSource
Modicon M340 CPU (part numbers BMXP34*)Versions prior to SV3.65–CNA
Modicon MC80 (part numbers BMKC80)All versions–CNA
Modicon Momentum Unity M1E Processor (171CBU*)All Versions–CNA
modicon_m340< SV3.65SV3.65CISA-ADP
modicon_mc80all versions–CISA-ADP
modicon_momentum_unity_m1e_processorall versions–CISA-ADP

Scores by source

schneider (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
schneider (CNA)8.1CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refdownload.schneider-electric.com/doc/SEVD-2024-317-03/SEVD-2024-317-03.pdf