Schneider Electric Sage 1410
En bref
- Source
- NVD
- EPSS
- EPSS 0.37 % · centile 31 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- schneider
- Statut NVD
- Modified
Rechercher sur…
Description
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
Faiblesses (CWE)
- CWE-276 — Permissions par défaut incorrectes
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | schneider |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · cybersecurity@se.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2024-36405
- GCVE · GCVE-0-2024-37038
Avis du CERT-FR
- CERTFR-2024-AVI-0476 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:schneider-electric:sage_rtu_firmware:*:*:*:*:*:*:*:*< c3414-500-s02k5_p9
Produits affectés
| Produit | Versions |
|---|---|
| Schneider Electric · Sage 1410 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 1430 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 1450 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 2400 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 3030 Magnum | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 4400 | affected Versions C3414-500-S02K5_P8 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |