CVE-2024-8937 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Electric Modicon M340 CPU

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer3 documents3 sources

Severity

8.3HIGHNVD

EPSS

0.1%

top 72.08%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Schneider Electric Modicon M340 CPU Schneider Electric Modicon Mc80 Schneider Electric Modicon Momentum Unity M1E Processor

Timeline

PublishedNov 13

Description

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in the authentication process.

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Affected Packages3 packages

▶CVEListV5schneider_electric/modicon_momentum_unity_m1e_processorAll Versions

▶CVEListV5schneider_electric/modicon_mc80All versions

▶CVEListV5schneider_electric/modicon_m340_cpuVersions prior to SV3.65

🔴Vulnerability Details

GHSA

GHSA-9pjf-rrr2-qjqf: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code exec↗2024-11-13

▶

CVEList

CVE-2024-8937: CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code exec↗2024-11-13

▶