342975 matches found
CVE-2024-5559
CWE-327: Use of a Broken or Risky Cryptographic Algorithm vulnerability exists that could cause denial of service, device reboot, or an attacker gaining full control of the relay when a specially crafted reset token is entered into the front panel of the device...
CVE-2024-5558
CWE-367: Time-of-check Time-of-use TOCTOU Race Condition vulnerability exists that could cause escalation of privileges when an attacker abuses a limited admin account...
CVE-2024-37040
CWE-120: Buffer Copy without Checking Size of Input ‘Classic Buffer Overflow’ vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request...
CVE-2024-37039
CWE-252: Unchecked Return Value vulnerability exists that could cause denial of service of the device when an attacker sends a specially crafted HTTP request...
CVE-2024-37037
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...
CVE-2024-2747
CWE-428: Unquoted search path or element vulnerability exists in Easergy Studio, which could cause privilege escalation when a valid user replaces a trusted file name on the system and reboots the machine...
CVE-2024-2747
CVE-2024-2747 affects Schneider Electric Easergy Studio. The root cause is CWE-428: an unquoted search path/element, allowing a local attacker with low privileges to escalate privileges by replacing a trusted file name and rebooting the system. Impact is described as high for confidentiality, int...
CVE-2024-37040
CWE-120: Buffer Copy without Checking Size of Input ‘Classic Buffer Overflow’ vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request...
CVE-2024-37040
CVE-2024-37040 is associated with Schneider Electric Sage RTU devices. The vulnerability stems from a buffer copy without checking input size in the web interface, described as a classic Buffer Overflow (CWE-120). A malformed HTTP request could cause a fault in the device. Connected sources corro...
CVE-2024-37040
CWE-120: Buffer Copy without Checking Size of Input ‘Classic Buffer Overflow’ vulnerability exists that could allow a user with access to the device’s web interface to cause a fault on the device when sending a malformed HTTP request...
CVE-2024-37038
CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests...
CVE-2024-37037
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...
CVE-2024-37037
CVE-2024-37037 concerns a path traversal vulnerability in Schneider Electric Sage RTU devices. The authenticated attacker, with access to the device web interface, can exploit an improper limitation of a pathname to a restricted directory via a crafted HTTP request to corrupt files and impact dev...
CVE-2024-37037
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ‘Path Traversal’ vulnerability exists that could allow an authenticated user with access to the device’s web interface to corrupt files and impact device functionality when sending a crafted HTTP request...
CVE-2024-37036
CVE-2024-37036 affects Schneider Electric Sage RTU devices (SAGE RTU). The NVD entry describes an Out-of-bounds Write vulnerability (CWE-787) that could result in an authentication bypass when a malformed POST request is sent with certain configuration parameters. Several connected sources corrob...
CVE-2024-5560
CVE-2024-5560 affects Schneider Electric Sage RTUs, with an out-of-bounds read in the web interface that could cause DoS when a specially crafted HTTP request is sent. Multiple connected sources describe the issue as a vulnerability in the Sage RTU/web interface, linked to CWE-125 (Out-of-bounds ...
CVE-2024-5560
CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a specially crafted HTTP request...
CVE-2024-5560
CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service of the device’s web interface when an attacker sends a specially crafted HTTP request...
CVE-2024-5557
CVE-2024-5557 describes a CWE-532 log message disclosure in Schneider Electric SpaceLogic AS-P/AS-B where SNMP credentials can be exposed if an attacker has access to controller logs. The core issue is insertion of sensitive information into log files. Affected products are Schneider Electric Spa...