CVE-2024-37038
First published: Wed Jun 12 2024(Updated: )
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Schneider-electric Sage Rtu Firmware | <c3414-500-s02k5_p9 | |
| Any of | ||
| Schneider-electric Sage 1410 | ||
| Schneider-electric Sage 1430 | ||
| Schneider-electric Sage 1450 | ||
| Schneider-electric Sage 2400 | ||
| Schneider-electric Sage 3030 Magnum | ||
| Schneider-electric Sage 4400 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-37038?
CVE-2024-37038 is classified as a moderate severity vulnerability due to the potential for unauthorized file and firmware uploads.
How do I fix CVE-2024-37038?
To fix CVE-2024-37038, ensure that appropriate access controls and permissions are in place for the device's web interface.
Who is affected by CVE-2024-37038?
CVE-2024-37038 affects users of Schneider Electric's Sage RTU firmware up to version c3414-500-s02k5.
What type of attack can occur due to CVE-2024-37038?
An attacker can exploit CVE-2024-37038 to perform unauthorized file and firmware uploads by crafting custom web requests.
Is there a patch available for CVE-2024-37038?
Users should check the manufacturer's announcements for any updates or patches addressing CVE-2024-37038.
- agent/weakness
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/severity
- agent/remedy
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- vendor/schneider-electric
- canonical/schneider-electric sage rtu firmware
- canonical/schneider-electric sage 1410
- canonical/schneider-electric sage 1430
- canonical/schneider-electric sage 1450
- canonical/schneider-electric sage 2400
- canonical/schneider-electric sage 3030 magnum
- canonical/schneider-electric sage 4400