Lucene search

EatonCVE-2024-31415

HistorySep 13, 2024 - 5:15 p.m.

CVE-2024-31415

2024-09-1317:15:11

CWE-522

Eaton

web.nvd.nist.gov

eaton foreseer software

external servers

network management

user management

encryption keys

insecure storage

configuration changes

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

20.2%

JSON

The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encryption were insecurely stored, which could be abused to possibly change or remove the server configuration.

Affected configurations

Nvd

Node

eatonforeseer_electrical_power_monitoring_systemRange<7.8.600

VendorProductVersionCPE
eatonforeseer_electrical_power_monitoring_system*cpe:2.3:a:eaton:foreseer_electrical_power_monitoring_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
eaton	foreseer_electrical_power_monitoring_system	*	cpe:2.3:a:eaton:foreseer_electrical_power_monitoring_system::::::::

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Foreseer",
    "vendor": "Eaton",
    "versions": [
      {
        "lessThan": "7.8.500",
        "status": "affected",
        "version": "0",
        "versionType": "custom"
      }
    ]
  }
]

References

www.eaton.com/content/dam/eaton/company/news-insights/cybersecurity/security-bulletins/etn-va-2024-1008.pdf

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

AI Score

Confidence

Low

EPSS

0.001

Percentile

20.2%

JSON

Related for CVE-2024-31415