VDB

CVE-2024-37038

CVE-2024-37038 PUBLISHED CVSS 7.5 HIGH

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.

EPSS 0.29% · 52.9th percentile

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.29%
52.9th percentile

Affected Products

VendorProductVersions
Schneider ElectricSage 3030 MagnumVersions C3414-500-S02K5_P8 and prior, Versions C3414-500-S02K5_P8 and prior
schneider_electricsage_3030m0, 0
schneider_electricsage_44000, 0
Schneider ElectricSage 4400Versions C3414-500-S02K5_P8 and prior, Versions C3414-500-S02K5_P8 and prior
Schneider ElectricSage 2400Versions C3414-500-S02K5_P8 and prior, Versions C3414-500-S02K5_P8 and prior
schneider_electricsage_14300, 0
schneider_electricsage_14500, 0
schneider_electricsage_14100, 0
schneider-electricsage_rtu_firmware0, 0, 0
Schneider ElectricSage 1410Versions C3414-500-S02K5_P8 and prior, Versions C3414-500-S02K5_P8 and prior
Schneider ElectricSage 1430Versions C3414-500-S02K5_P8 and prior, Versions C3414-500-S02K5_P8 and prior
schneider_electricsage_24000, 0
Schneider ElectricSage 1450Versions C3414-500-S02K5_P8 and prior, Versions C3414-500-S02K5_P8 and prior

Timeline

  • Jun 11, 2024 CVE Published
  • Jun 13, 2024 EPSS Score
  • Jul 6, 2024 EPSS Score
  • Jul 29, 2024 EPSS Score
  • Aug 21, 2024 EPSS Score
  • Sep 13, 2024 EPSS Score
  • Oct 4, 2024 Coalition ESS Score
  • Oct 6, 2024 EPSS Score
  • Oct 29, 2024 EPSS Score
  • Nov 21, 2024 EPSS Score
  • Dec 14, 2024 EPSS Score
  • Jan 6, 2025 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›