CVE-2024-37038: High severity schneider-electric sage rtu firmware vulnerability
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37038?
CVE-2024-37038 is classified as a moderate severity vulnerability due to the potential for unauthorized file and firmware uploads.
How do I fix CVE-2024-37038?
To fix CVE-2024-37038, ensure that appropriate access controls and permissions are in place for the device's web interface.
Who is affected by CVE-2024-37038?
CVE-2024-37038 affects users of Schneider Electric's Sage RTU firmware up to version c3414-500-s02k5.
What type of attack can occur due to CVE-2024-37038?
An attacker can exploit CVE-2024-37038 to perform unauthorized file and firmware uploads by crafting custom web requests.
Is there a patch available for CVE-2024-37038?
Users should check the manufacturer's announcements for any updates or patches addressing CVE-2024-37038.