PT-2024-7818 · Schneider Electric · Ecostruxure It Gateway

Published 2024-11-11 · Updated 2024-11-19 · CVE-2024-10575

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Schneider Electric EcoStruxure IT Gateway (affected versions not specified)

Description A Missing Authorization vulnerability exists that could cause unauthorized access when enabled on the network and potentially impacting connected devices. The vulnerability is related to the absence of an authorization procedure in the software for communicating with controlled devices. Exploitation of the vulnerability may allow a remote attacker to gain full access to the vulnerable software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-09318

CVE-2024-10575

Affected Products

Ecostruxure It Gateway

References · 11

• https://download.schneider-electric.com/doc/SEVD-2024-317-04/SEVD-2024-317-04.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-10575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10575 · Security Note
• https://bdu.fstec.ru/vul/2024-09318 · Security Note
• https://t.me/pentestingnews/53161 · Telegram Post
• https://twitter.com/CVEnew/status/1856694180632019218 · Twitter Post
• https://t.me/cvedetector/10806 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1856591844945092860 · Twitter Post
• https://twitter.com/ohhara_shiojiri/status/1856523672951107966 · Twitter Post
• https://t.me/cvenotify/101499 · Telegram Post
• https://twitter.com/the_yellow_fall/status/1856520553764675927 · Twitter Post