PT-2024-9213 · Schneider Electric · Modicon Mc80 Bmkc80+2

Published

2024-11-12

·

Updated

2024-11-13

·

CVE-2024-8938

CVSS v4.0

9.2

Critical

VectorAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon M340 CPU BMXP34, Modicon MC80 BMKC80, and Modicon Momentum Unity M1E Processor 171CBU (affected versions not specified)
Description: A vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call to tamper with the memory area involved in memory size computation. This issue is related to improper restriction of operations within the bounds of a memory buffer. The vulnerability may allow a remote attacker to implement a Man-In-The-Middle attack.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2024-10901
CVE-2024-8938

Affected Products

Modicon Mc80 Bmkc80
Modicon Momentum Unity M1E Processor 171Cbu
Schneider Electric Modicon M340 Cpu Bmxp34