CVE-2024-8933

HIGH EPSS 19.9%

Published Nov 13, 20241y ago · Modified Jun 17, 20262w ago

7.5 CVSS 4.0

High

Published Nov 13, 2024 1y ago

Last Modified Jun 17, 2026 2w ago

Description

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.

CVSS Details

Base Score

7.5

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction A

Scope X

Threat Intelligence

EPSS Exploit Probability

19.9% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-924

References 1

download.schneider-electric.com https://download.schneider-electric.com/doc/SEVD-2024-317-02/SEVD-2024-317-02.pdf

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.