PT-2024-1508 · Se Elektronic Gmbh · E-Ddc3.3

Carlos Antonini · Published 2024-01-29 · Updated 2025-01-03 · CVE-2024-1014

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions SE-elektronic GmbH E-DDC3.3 versions 03.07.03 and higher

Description The issue is related to uncontrolled resource consumption in the web interface of the E-DDC3.3 automation station software. This could allow a remote attacker to cause a denial of service by sending multiple ICMP packets, interrupting the availability of the administration panel.

Recommendations For versions 03.07.03 and higher, consider restricting access to the administration panel to minimize the risk of exploitation until a patch is available. As a temporary workaround, limit the number of ICMP packets that can be sent to the device to prevent uncontrolled resource consumption.

Exploit

Fix

Resource Exhaustion

Code Injection

Weakness Enumeration

CWE-400

CWE-94

Related Identifiers

BDU:2024-00925

BDU:2024-01018

CVE-2024-1014

Affected Products

E-Ddc3.3

References · 11

• 🔥 https://hackplayers.com/2024/01/cve-2024-1014-and-cve-2024-1015.html · Exploit
• https://bdu.fstec.ru/vul/2024-01018 · Security Note
• https://bdu.fstec.ru/vul/2024-00925 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-1014 · Security Note
• https://osv.dev/vulnerability/CVE-2024-1014 · Vendor Advisory
• https://incibe.es/en/incibe-cert/notices/aviso-sci/multiple-vulnerabilities-se-elektronic-gmbh-products · Note
• https://t.me/cvenotify/105495 · Telegram Post
• https://t.me/cvenotify/69191 · Telegram Post
• https://t.me/cvenotify/69190 · Telegram Post
• https://t.me/cvenotify/105496 · Telegram Post
• https://vuldb.com/?id.252305 · Note