CVE-2024-6528: XSS
First published: Thu Jul 11 2024(Updated: )
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause a vulnerability leading to a cross-site scripting condition where attackers can have a victim’s browser run arbitrary JavaScript when they visit a page containing the injected payload.
Credit: cybersecurity@se.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Schneider Electric Modicon M241 | ||
| Schneider Electric Modicon M241 | ||
| All of | ||
| schneider-electric Modicon M251 firmware | ||
| schneider-electric Modicon M251 | ||
| All of | ||
| Schneider Electric Modicon M258 | ||
| Schneider Electric Modicon M258 | ||
| All of | ||
| Schneider Electric Modicon M262 Firmware | ||
| Schneider Electric Modicon M262 Firmware | ||
| All of | ||
| schneider-electric Modicon LMC058 firmware | ||
| schneider-electric Modicon LMC058 firmware |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2024-6528?
CVE-2024-6528 is classified as a cross-site scripting vulnerability which poses a medium severity risk.
How do I fix CVE-2024-6528?
To fix CVE-2024-6528, you should apply the latest firmware updates provided by Schneider Electric for the affected Modicon models.
What are the affected products for CVE-2024-6528?
CVE-2024-6528 affects Schneider Electric Modicon M241, M251, M258, M262, and LMC058 firmware versions.
Can CVE-2024-6528 be exploited remotely?
Yes, CVE-2024-6528 can potentially be exploited remotely if a user visits a malicious webpage.
What kind of attack does CVE-2024-6528 enable?
CVE-2024-6528 enables cross-site scripting attacks that allow attackers to execute arbitrary JavaScript in a victim's browser.
- agent/weakness
- agent/references
- agent/description
- agent/type
- agent/first-publish-date
- agent/author
- agent/event
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/epss
- collector/epss-latest
- source/FIRST
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/schneider-electric
- canonical/schneider electric modicon m241
- canonical/schneider-electric modicon m251 firmware
- canonical/schneider-electric modicon m251
- canonical/schneider electric modicon m258
- canonical/schneider electric modicon m262 firmware
- canonical/schneider-electric modicon lmc058 firmware