SB2024112632 - Multiple vulnerabilities in Schneider Electric Modicon M340, MC80, and Momentum Unity M1E

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Improper Enforcement of Message Integrity During Transmission in a Communication Channel (CVE-ID: CVE-2024-8933)

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper enforcement of message integrity during transmission in a communication channel. A remote attacker can inject themselves inside the logical network while a valid user uploads or downloads a project file into the controller, gain access to password hash and execute arbitrary code on the system.

2) Authentication Bypass by Spoofing (CVE-ID: CVE-2024-8935)

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an authentication bypass issue. A remote attacker can perform a man-in-the-middle (MitM) attack and bypass authentication on the target system.

Remediation

Cybersecurity Help is not aware of any official remediation provided by the vendor.

References

• https://download.schneider-electric.com/doc/SEVD-2024-317-02/SEVD-2024-317-02.pdf
• https://www.cisa.gov/news-events/ics-advisories/icsa-24-326-03