Schneider Electric Modicon M340 CPU (part numbers BMXP34*) Password Hash message integrity

Summaryinfo

A vulnerability was found in Schneider Electric Modicon M340 CPU (part numbers BMXP34*), Modicon MC80 (part numbers BMKC80) and Modicon Momentum Unity M1E Processor (171CBU*). It has been declared as critical. This impacts an unknown function of the component Password Hash Handler. The manipulation results in message integrity. This vulnerability is cataloged as CVE-2024-8933. The attack may be launched remotely. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability, which was classified as critical, was found in Schneider Electric Modicon M340 CPU (part numbers BMXP34*), Modicon MC80 (part numbers BMKC80) and Modicon Momentum Unity M1E Processor (171CBU*) (version now known). Affected is some unknown processing of the component Password Hash Handler. The manipulation with an unknown input leads to a message integrity vulnerability. CWE is classifying the issue as CWE-924. The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.

The advisory is shared for download at download.schneider-electric.com. This vulnerability is traded as CVE-2024-8933 since 09/17/2024. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

Applying a patch is able to eliminate this problem.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• SCADA Software

Vendor

• Schneider Electric

Name

• Modicon M340 CPU (part numbers BMXP34*)
• Modicon MC80 (part numbers BMKC80)
• Modicon Momentum Unity M1E Processor (171CBU*)

License

• commercial

Website

• Vendor: https://www.schneider-electric.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion