Find a vulnerability

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

2 vulnerabilities found for sage_3030m by schneider_electric

CVE-2024-37038 (GCVE-0-2024-37038)

Vulnerability from nvd – Published: 2024-06-12 16:51 – Updated: 2024-08-02 03:43

Summary

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-06-12 17:44 UTC

CWE

CWE-276 - Incorrect Default Permissions

Assigner

schneider CNA under the mitre root

CNA scorecard C 65/100 over 23 records in the last 180 days details

References

1 reference

URL	Tags
https://download.schneider-electric.com/files?p_D…

Impacted products

12 products

Vendor	Product	Version
Schneider Electric	Sage 1410	Affected: Versions C3414-500-S02K5_P8 and prior
Schneider Electric	Sage 1430	Affected: Versions C3414-500-S02K5_P8 and prior
Schneider Electric	Sage 1450	Affected: Versions C3414-500-S02K5_P8 and prior
Schneider Electric	Sage 2400	Affected: Versions C3414-500-S02K5_P8 and prior
Schneider Electric	Sage 3030 Magnum	Affected: Versions C3414-500-S02K5_P8 and prior
Schneider Electric	Sage 4400	Affected: Versions C3414-500-S02K5_P8 and prior
schneider_electric	sage_4400	Affected: 0 , ≤ c3414-500-s02k5_p8 (custom) cpe:2.3:h:schneider_electric:sage_4400::::::::
schneider_electric	sage_1430	Affected: 0 , ≤ c3414-500-s02k5_p8 (custom) cpe:2.3:h:schneider_electric:sage_1430::::::::
schneider_electric	sage_2400	Affected: 0 , ≤ c3414-500-s02k5_p8 (custom) cpe:2.3:h:schneider_electric:sage_2400::::::::
schneider_electric	sage_3030m	Affected: 0 , ≤ c3414-500-s02k5_p8 (custom) cpe:2.3:h:schneider_electric:sage_3030m::::::::
schneider_electric	sage_1410	Affected: 0 , ≤ c3414-500-s02k5_p8 (custom) cpe:2.3:h:schneider_electric:sage_1410::::::::
schneider_electric	sage_1450	Affected: 0 , ≤ c3414-500-s02k5_p8 (custom) cpe:2.3:h:schneider_electric:sage_1450::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_4400:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_4400",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_1430:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_1430",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_2400:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_2400",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_3030m:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_3030m",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_1410:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_1410",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:h:schneider_electric:sage_1450:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "sage_1450",
            "vendor": "schneider_electric",
            "versions": [
              {
                "lessThanOrEqual": "c3414-500-s02k5_p8",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-37038",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-06-12T17:44:53.062764Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-12T17:54:11.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T03:43:50.738Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Sage 1410",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 1430",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 1450",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 2400",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 3030 Magnum",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Sage 4400",
          "vendor": "Schneider Electric",
          "versions": [
            {
              "status": "affected",
              "version": "Versions C3414-500-S02K5_P8 and prior"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\n\n\n\n\n\n\n\nCWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\nuser with access to the device\u2019s web interface to perform unauthorized file and firmware\nuploads when crafting custom web requests.\n\n\n\n\n\n\n\n"
            }
          ],
          "value": "CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated\nuser with access to the device\u2019s web interface to perform unauthorized file and firmware\nuploads when crafting custom web requests."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-276",
              "description": "CWE-276 Incorrect Default Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-12T16:51:55.800Z",
        "orgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
        "shortName": "schneider"
      },
      "references": [
        {
          "url": "https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-05\u0026p_enDocType=Security+and+Safety+Notice\u0026p_File_Name=SEVD-2024-163-05.pdf"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "076d1eb6-cfab-4401-b34d-6dfc2a413bdb",
    "assignerShortName": "schneider",
    "cveId": "CVE-2024-37038",
    "datePublished": "2024-06-12T16:51:55.800Z",
    "dateReserved": "2024-05-31T06:52:05.762Z",
    "dateUpdated": "2024-08-02T03:43:50.738Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}