Schneider Electric Power Logic Authorization Bypass Through User-Controlled Key (CVE-2024-10497)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502850);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/02/14");

  script_cve_id("CVE-2024-10497");
  script_xref(name:"ICSA", value:"25-028-02");

  script_name(english:"Schneider Electric Power Logic Authorization Bypass Through User-Controlled Key (CVE-2024-10497)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"CWE-639: Authorization Bypass Through User-Controlled Key
vulnerability exists that could allow an authorized attacker to modify
values outside those defined by their privileges (Elevation of
Privileges) when the attacker sends modified HTTPS requests to the
device.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-08&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-08.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?bda75d44");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-028-02");
  script_set_attribute(attribute:"solution", value:
"The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

- (CVE-2024-10497) Schneider Electric Power Logic HDPM6000 Version 0.62.7 only: Version v0.62.11 and newer of HDPM6000
includes a fix for these vulnerabilities and is available for download here. A device restart will occur as part of the
firmware update process if conducted through the web user interface. If the upgrade is performed using the HDPM6000
Manager software, the device will need to be restarted manually to apply the update.
- (CVE-2024-10497) Schneider Electric Power Logic HDPM6000 Version 0.62.7 only: If users choose not to apply the
remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
Ensure that the device is not accessible via the HTTPS protocol outside the local network segment by applying
appropriate firewalls configuration and controls, and that access to the network segment is protected and controlled.
- (CVE-2024-10498) Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior: Version v0.62.11 and newer of
HDPM6000 includes a fix for these vulnerabilities and is available for download here. A device restart will occur as
part of the firmware update process if conducted through the web user interface. If the upgrade is performed using the
HDPM6000 Manager software, the device will need to be restarted manually to apply the update.
- (CVE-2024-10498) Schneider Electric Power Logic HDPM6000 Versions 0.62.7 and prior: If users choose not to apply the
remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit:
Ensure that the device is not accessible via the Modbus protocol outside the local network segment by applying
appropriate firewalls configuration and controls, and that access to the network segment is protected and controlled.

For more information, please see Schneider Electric's advisory.");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-10497");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(639);

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/01/17");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/01/17");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/02/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:powerlogic_hdpm6000_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Schneider");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Schneider');

var asset = tenable_ot::assets::get(vendor:'Schneider');

var vuln_cpes = {
    "cpe:/o:schneider-electric:powerlogic_hdpm6000_firmware" :
        {"versionEndIncluding" : "0.62.7", "versionStartIncluding" : "0.62.7", "family" : "PowerLogicHDPM"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_HOLE);