Schneider Electric Sage 1410
At a glance
- Source
- NVD
- EPSS
- EPSS 0.37 % · percentile 31 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- schneider
- NVD status
- Modified
Description
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
Weaknesses (CWE)
- CWE-276 — Incorrect Default Permissions
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | schneider |
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · cybersecurity@se.com (Secondary) |
| CVSS 3.1 | HIGH 8.8 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2024-36405
- GCVE · GCVE-0-2024-37038
CERT-FR advisories
- CERTFR-2024-AVI-0476 — Multiples vulnérabilités dans les produits Schneider Electric · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:schneider-electric:sage_rtu_firmware:*:*:*:*:*:*:*:*< c3414-500-s02k5_p9
Affected products
| Product | Versions |
|---|---|
| Schneider Electric · Sage 1410 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 1430 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 1450 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 2400 | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 3030 Magnum | affected Versions C3414-500-S02K5_P8 and prior |
| Schneider Electric · Sage 4400 | affected Versions C3414-500-S02K5_P8 and prior |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |