Main Vulnerability Database Vulnerabilities #VU103694

Information disclosure in Schneider Electric products - CVE-2024-12142

Published: February 7, 2025

Vulnerability identifier: #VU103694

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-12142

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to excessive data output by the application. A remote attacker can gain unauthorized access to sensitive information on the system, leading to modification of web page and denial of service (DoS) condition.

Affected software

Modicon M340
BMXNOE0100
BMXNOE0110
BMXNOR0200H

How to mitigate CVE-2024-12142

Install updates from vendor's website.

BMXNOR0200H - update to SV1.70IR26

External References

Related Security Bulletins

Information disclosure in Schneider Electric Modicon M340 and BMXNOE0100/0110, BMXNOR0200H