Schneider Electric Modicon M340, BMXNOE0100, and BMXNOE0110 Files or Directories Accessible to External Parties (CVE-2024-5056)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(502368);
  script_version("1.7");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/07");

  script_cve_id("CVE-2024-5056");
  script_xref(name:"ICSA", value:"25-254-09");

  script_name(english:"Schneider Electric Modicon M340, BMXNOE0100, and BMXNOE0110 Files or Directories Accessible to External Parties (CVE-2024-5056)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"CWE-552: Files or Directories Accessible to External Parties
vulnerability exists which may prevent user to update the device
firmware and prevent proper behavior of the webserver when specific
files or directories are removed from the filesystem.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  # https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-163-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-163-01.pdf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?11345144");
  script_set_attribute(attribute:"see_also", value:"https://www.cisa.gov/news-events/ics-advisories/icsa-25-254-09");
  script_set_attribute(attribute:"solution", value:
'The following text was originally created by the Cybersecurity and Infrastructure Security Agency (CISA). The original
can be found at CISA.gov.

Schneider Electric has identified the following specific workarounds and mitigations users can apply to reduce risk:

Modbus/TCP Ethernet Modicon M340 module: Version SV3.60 of BMXNOE0100 includes a fix for this vulnerability and is
available for download here.

Modbus/TCP Ethernet Modicon M340 FactoryCast module: Version SV6.80 of BMXNOE0110 includes a fix for this vulnerability
and is available for download here.

Schneider Electric is establishing a remediation plan for all future versions of Modicon M340 that will include a fix
for this vulnerability. They will provide an update when the remediation is available. Until then, users should
immediately apply the following mitigations to reduce the risk of exploit:

- Set up network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the
devices.
- FTP service is disabled by default. Deactivate the FTP service after use when not needed.
- Configure the Access Control List following the recommendations of the user manual "Modicon M340 for Ethernet
Communications Modules and Processors User Manual" in chapter "Messaging Configuration Parameters".

For more information see the associated Schneider Electric CPCERT security advisory SEVD-2024-163-01, SEVD-2024-163-01
CSAF Version.');
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-5056");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(552);

  script_set_attribute(attribute:"vuln_publication_date", value:"2024/06/12");
  script_set_attribute(attribute:"patch_publication_date", value:"2024/06/12");
  script_set_attribute(attribute:"plugin_publication_date", value:"2024/08/26");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxnoe0100_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:schneider-electric:modicon_m340_bmxnoe0110_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2024-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/Schneider");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/Schneider');

var asset = tenable_ot::assets::get(vendor:'Schneider');

var vuln_cpes = {
    "cpe:/o:schneider-electric:modicon_m340_firmware" :
        {"family" : "ModiconM340"},
    "cpe:/o:schneider-electric:modicon_m340_bmxnoe0100_firmware" :
        {"family" : "ModiconM340M580CP", "versionEndExcluding" : "sv3.60"},
    "cpe:/o:schneider-electric:modicon_m340_bmxnoe0110_firmware" :
        {"family" : "ModiconM340M580CP", "versionEndExcluding" : "sv6.80"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);