CVE-2024-8933 Information disclosure in Modicon M340 CPU (part numbers BMXP34*)
An attacker on the network can intercept password hashes during file transfers, leading to confidentiality loss and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-8933?
CVE-2024-8933 is a high-severity vulnerability in Schneider Electric Modicon M340 CPU (part numbers BMXP34*), published on 13 Nov 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause retrieval of password hash that could lead to denial of service and loss of confidentiality and integrity of controllers. To be successful, the attacker needs to inject themself inside the logical network while a valid user uploads or downloads a project file into the controller.
Weakness: CWE-924
Which versions are affected by CVE-2024-8933?
How do I fix CVE-2024-8933?
No fix has been published for CVE-2024-8933 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-8933 being exploited?
There is no known exploitation of CVE-2024-8933 in the wild and no public exploit code.
Sources
Also known as GHSA-w33h-3r53-4xwj.