CVE-2024-8936 — Improper Input Validation in Electric Modicon M340 CPU

CWE-20 — Improper Input Validation3 documents3 sources
Severity
8.3HIGHNVD
EPSS
0.1%
top 71.56%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Schneider Electric Modicon M340 CPU
Timeline
PublishedNov 13

Description

CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call used to tamper with memory.

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages1 packages

▶CVEListV5schneider_electric/modicon_m340_cpuVersions prior to SV3.65

🔴Vulnerability Details

2
GHSA
GHSA-rrmf-46w6-f74r: CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-M↗2024-11-13
▶
CVEList
CVE-2024-8936: CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-M↗2024-11-13
▶
CVE-2024-8936 — Improper Input Validation | cvebase