Vulnerability · Published Jul 11, 2024 · Assigned by schneider
CVE-2024-2602
High 7.3
In plain English
A high-severity path traversal in FoxRTU Station from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)0.3%top 79.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could result in remote code execution when an authenticated user executes a saved project file that has been tampered by a malicious actor.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | FoxRTU Station | All versions prior to v9.3.0 |
Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H