PT-2024-9214 · Schneider Electric · Schneider Electric Modicon M340 Cpu Bmxp34

Published

2024-11-12

·

Updated

2024-11-13

·

CVE-2024-8935

CVSS v4.0

7.7

High

VectorAV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions: Schneider Electric Modicon M340 CPU BMXP34 (affected versions not specified)
Description: The issue is related to an authentication bypass vulnerability in the Diffie-Hellman algorithm, which can be exploited to conduct a Man-In-The-Middle attack between the controller and the engineering workstation. This could lead to a denial of service and loss of confidentiality and integrity of controllers. The vulnerability is inherent to the Diffie-Hellman algorithm, which does not protect against Man-In-The-Middle attacks.
Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass by Spoofing

Weakness Enumeration

CWE-290

Related Identifiers

BDU:2024-10902
CVE-2024-8935

Affected Products

Schneider Electric Modicon M340 Cpu Bmxp34