CVE-2024-8933 — Schneider Electric / Modicon M340 CPU (part numbers BMXP34*)

Description (CNA)

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.

Affected (CNA)

Vendor / product	Versions
Schneider Electric / Modicon M340 CPU (part numbers BMXP34*)	affected All versions
Schneider Electric / Modicon MC80 (part numbers BMKC80)	affected All versions
Schneider Electric / Modicon Momentum Unity M1E Processor (171CBU*)	affected All Versions

CWE

CWE-924

References

https://download.schneider-electric.com/doc/SEVD-2024-317-02/SEVD-2024-317-02.pdf

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.