Vulnerability · Published Jun 12, 2024 · Assigned by schneider
CVE-2024-37040
Medium 5.4
In plain English
A medium-severity buffer overflow in Sage 1410 from Schneider Electric. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.4%top 66.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
CWE-120: Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Schneider Electric | Sage 1410 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 1430 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 1450 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 2400 | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 3030 Magnum | Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric | Sage 4400 | Versions C3414-500-S02K5_P8 and prior |
Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L