cve-2024-37038
Vulnerability from cvelistv5
Published
2024-06-12 16:51
Modified
2024-08-02 03:43
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
References
cybersecurity@se.comhttps://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdfPatch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-05.pdfPatch, Vendor Advisory
Impacted products
Vendor Product Version
Schneider Electric Sage 1430 Version: Versions C3414-500-S02K5_P8 and prior
Schneider Electric Sage 1450 Version: Versions C3414-500-S02K5_P8 and prior
Schneider Electric Sage 2400 Version: Versions C3414-500-S02K5_P8 and prior
Schneider Electric Sage 3030 Magnum Version: Versions C3414-500-S02K5_P8 and prior
Schneider Electric Sage 4400 Version: Versions C3414-500-S02K5_P8 and prior
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_4400:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_4400",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_1430:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_1430",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_2400:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_2400",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_3030m:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_3030m",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_1410:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_1410",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_1450:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_1450",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T17:44:53.062764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T17:54:11.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.738Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Sage 1410",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 1430",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 1450",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 2400",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 3030 Magnum",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 4400",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\n\n\n\n\n\nCWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\nuser with access to the device\u2019s web interface to perform unauthorized file and firmware\nuploads when crafting custom web requests.\n\n\n\n\n\n\n\n"
            }
          ],
          "value": "CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\nuser with access to the device\u2019s web interface to perform unauthorized file and firmware\nuploads when crafting custom web requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-12T16:51:55.800Z",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2024-37038",
    "datePublished": "2024-06-12T16:51:55.800Z",
    "dateReserved": "2024-05-31T06:52:05.762Z",
    "dateUpdated": "2024-08-02T03:43:50.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:schneider-electric:sage_rtu_firmware:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"c3414-500-s02k5_p9\", \"matchCriteriaId\": \"D4DDD3DD-576C-404E-A132-D1357936A610\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"02E606BD-92F8-4396-AD13-666D76E1E34D\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"97E29CCC-4E21-411E-80DD-545A66E9B042\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"66759867-027F-4FA6-ABA6-BFDEE49E8F8D\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AA561E2A-4787-48D7-ABBB-26D0D7D24E6F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"453696F2-0F4C-4000-A438-F814D0FC3504\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6462B366-8F9F-49D6-939A-E73C1D5A707C\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\\nuser with access to the device\\u2019s web interface to perform unauthorized file and firmware\\nuploads when crafting custom web requests.\"}, {\"lang\": \"es\", \"value\": \"CWE-276: Existe una vulnerabilidad de permisos predeterminados incorrectos que podr\\u00eda permitir que un usuario autenticado con acceso a la interfaz web del dispositivo realice cargas de archivos y firmware no autorizadas al crear solicitudes web personalizadas.\"}]",
      "id": "CVE-2024-37038",
      "lastModified": "2024-11-21T09:23:05.867",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"cybersecurity@se.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 5.9}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 8.8, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 5.9}]}",
      "published": "2024-06-12T17:15:51.080",
      "references": "[{\"url\": \"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf\", \"source\": \"cybersecurity@se.com\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}, {\"url\": \"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Vendor Advisory\"]}]",
      "sourceIdentifier": "cybersecurity@se.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"cybersecurity@se.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-276\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-276\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-37038\",\"sourceIdentifier\":\"cybersecurity@se.com\",\"published\":\"2024-06-12T17:15:51.080\",\"lastModified\":\"2024-11-21T09:23:05.867\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\\nuser with access to the device\u2019s web interface to perform unauthorized file and firmware\\nuploads when crafting custom web requests.\"},{\"lang\":\"es\",\"value\":\"CWE-276: Existe una vulnerabilidad de permisos predeterminados incorrectos que podr\u00eda permitir que un usuario autenticado con acceso a la interfaz web del dispositivo realice cargas de archivos y firmware no autorizadas al crear solicitudes web personalizadas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"cybersecurity@se.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.6,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"cybersecurity@se.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-276\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:schneider-electric:sage_rtu_firmware:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"c3414-500-s02k5_p9\",\"matchCriteriaId\":\"D4DDD3DD-576C-404E-A132-D1357936A610\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"02E606BD-92F8-4396-AD13-666D76E1E34D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"97E29CCC-4E21-411E-80DD-545A66E9B042\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66759867-027F-4FA6-ABA6-BFDEE49E8F8D\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA561E2A-4787-48D7-ABBB-26D0D7D24E6F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"453696F2-0F4C-4000-A438-F814D0FC3504\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6462B366-8F9F-49D6-939A-E73C1D5A707C\"}]}]}],\"references\":[{\"url\":\"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf\",\"source\":\"cybersecurity@se.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf\", \"tags\": [\"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-02T03:43:50.738Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-37038\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-06-12T17:44:53.062764Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:h:schneider_electric:sage_4400:*:*:*:*:*:*:*:*\"], \"vendor\": \"schneider_electric\", \"product\": \"sage_4400\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"c3414-500-s02k5_p8\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:h:schneider_electric:sage_1430:*:*:*:*:*:*:*:*\"], \"vendor\": \"schneider_electric\", \"product\": \"sage_1430\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"c3414-500-s02k5_p8\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:h:schneider_electric:sage_2400:*:*:*:*:*:*:*:*\"], \"vendor\": \"schneider_electric\", \"product\": \"sage_2400\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"c3414-500-s02k5_p8\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:h:schneider_electric:sage_3030m:*:*:*:*:*:*:*:*\"], \"vendor\": \"schneider_electric\", \"product\": \"sage_3030m\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"c3414-500-s02k5_p8\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:h:schneider_electric:sage_1410:*:*:*:*:*:*:*:*\"], \"vendor\": \"schneider_electric\", \"product\": \"sage_1410\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"c3414-500-s02k5_p8\"}], \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:2.3:h:schneider_electric:sage_1450:*:*:*:*:*:*:*:*\"], \"vendor\": \"schneider_electric\", \"product\": \"sage_1450\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"c3414-500-s02k5_p8\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-06-12T17:53:40.561Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Schneider Electric\", \"product\": \"Sage 1410\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions C3414-500-S02K5_P8 and prior\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Schneider Electric\", \"product\": \"Sage 1430\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions C3414-500-S02K5_P8 and prior\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Schneider Electric\", \"product\": \"Sage 1450\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions C3414-500-S02K5_P8 and prior\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Schneider Electric\", \"product\": \"Sage 2400\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions C3414-500-S02K5_P8 and prior\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Schneider Electric\", \"product\": \"Sage 3030 Magnum\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions C3414-500-S02K5_P8 and prior\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Schneider Electric\", \"product\": \"Sage 4400\", \"versions\": [{\"status\": \"affected\", \"version\": \"Versions C3414-500-S02K5_P8 and prior\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\\nuser with access to the device\\u2019s web interface to perform unauthorized file and firmware\\nuploads when crafting custom web requests.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\\n\\n\\n\\n\\n\\n\\n\\nCWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\\nuser with access to the device\\u2019s web interface to perform unauthorized file and firmware\\nuploads when crafting custom web requests.\\n\\n\\n\\n\\n\\n\\n\\n\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-276\", \"description\": \"CWE-276 Incorrect Default Permissions\"}]}], \"providerMetadata\": {\"orgId\": \"076d1eb6-cfab-4401-b34d-6dfc2a413bdb\", \"shortName\": \"schneider\", \"dateUpdated\": \"2024-06-12T16:51:55.800Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-37038\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-08-02T03:43:50.738Z\", \"dateReserved\": \"2024-05-31T06:52:05.762Z\", \"assignerOrgId\": \"076d1eb6-cfab-4401-b34d-6dfc2a413bdb\", \"datePublished\": \"2024-06-12T16:51:55.800Z\", \"assignerShortName\": \"schneider\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.