Vulnerability · Published Jun 12, 2024 · Assigned by schneider
CVE-2024-37038
High 7.5
In plain English
A high-severity incorrect default permissions in Sage 1410 from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 68.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Sage 1410 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 1430 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 1450 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 2400 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 3030 Magnum | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 4400 | Versions C3414-500-S02K5_P8 and prior |
Weakness: CWE-276 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H