CVE-2024-11425
highPriorität · verfolgen · 0EPSS 0.006 · 50. PerzentilEUNLRUUSEPSS · bewertet 2026-10-27
CWE-131: Incorrect Calculation of Buffer Size vulnerability exists that could cause Denial-of-Service of the product when an unauthenticated user is sending a crafted HTTPS packet to the webserver.
Behebungen
Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.
Ein Hersteller-Fix ist verfügbar.
- BehobenBMENOR2200Hcisa_csaf_ot
SV4.02.01 of BMENOR2200H firmware includes a fix for this vulnerability and is available here: https://www.se.com/ww/en/product/BMENOR2200H/communication-module-modicon-m580-iec-608705101-104-dnp3-for-severe-environments/
https://www.se.com/ww/en/product/BMENOR2200H/communication-module-modicon-m580-iec-608705101-104-dnp3-for-severe-environments/ - BehobenEVLink Pro ACcisa_csaf_ot
V1.3.10 of EVLink Pro AC firmware includes a fix for this vulnerability and is available here: https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#software-and-firmware
https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#software-and-firmware - BehobenModicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety)cisa_csaf_ot
SV4.30 of Modicon M580 firmware includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware - BehobenModicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)cisa_csaf_ot
SV4.21 of Modicon M580 firmware includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware
https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/#software-and-firmware - MitigationBMENOR2200Hcisa_csaf_ot
If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit.• Setup network segmentation and implement a firewall to block all unauthorized access to port 443/TCP
- MitigationEVLink Pro ACcisa_csaf_ot
• Follow EVlink Pro AC cybersecurity guide https://www.se.com/ww/en/download/document/GEX5261101/
https://www.se.com/ww/en/download/document/GEX5261101/ - MitigationModicon M580 CPU (part numbers BMEP* and BMEH*, excluding M580 CPU Safety)cisa_csaf_ot
• Setup network segmentation and implement a firewall to block all unauthorized access to port 443/TCP • Configure the Access Control List following the recommendations of the user manuals: “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
https://www.se.com/ww/en/download/document/EIO0000001578/ - MitigationModicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)cisa_csaf_ot
• Setup network segmentation and implement a firewall to block all unauthorized access to port 443/TCP • Configure the Access Control List following the recommendations of the user manuals: “Modicon M580, Hardware, Reference Manual”: https://www.se.com/ww/en/download/document/EIO0000001578/
https://www.se.com/ww/en/download/document/EIO0000001578/
cvss
Technischer Schweregrad, 0–10. Eine Zeile je Quelle.
Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 6.6–8.7
SSVC
Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.
schwächen
Die CWE-Schwächeklassen, zu denen dies gehört.
betroffene Produkte (27)
Betroffene Produkte und Versionsbereiche.
- Schneider Electric Modicon M580 CPU Safety (part numbers BMEP58*S and BMEH58*S)≤ Versions prior to SV4.21enisa_euvdEU
Advisories (2)
Hersteller- und Ökosystem-Meldungen dazu.
- NCSC-2025-0019Kwetsbaarheden verholpen in Schneider Electric ModiconNL2025-01-16csaf · ncsc_nlNL
Schneider Electric heeft kwetsbaarheden verholpen in Modicon M340, M580 en diverse communicatiemodules.
- ICSA-25-035-04Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update A)2025-01-14icsa · cisa_csaf_otUS
Schneider Electric is aware of a vulnerability in its Modicon M580 PLCs (Programmable Logic Controllers) https://www.se.com/ww/en/product-range/62098-modicon-m580-epac/?parent-subcategory-id=3950&filter=business-1-industrial-automation-and-control#products , BMENOR2200H https://www.se.com/ww/en/product/BMENOR2200H/modicon-x80-module-coupleur-rtu-%C3%A9volu%C3%A9-sur-ethernet-1-port-s%C3%A9rie-durci/ and EVLink Pro AC https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#products products. Modicon M580 PLCs https://www.se.com/ww/en/product-subcategory/3950-pac-programmable-automation-controllers/?filter=business-1-industrial-automation-and-control control and monitor industrial operations. BMENOR2200H https://www.se.com/ww/en/product/BMENOR2200H/modicon-x80-module-coupleur-rtu-%C3%A9volu%C3%A9-sur-ethernet-1-port-s%C3%A9rie-durci/ is an advanced RTU communication module for Modicon M580 PLCs. EVLink Pro AC https://www.se.com/ww/en/product-range/23107242-evlink-pro-ac/#products is a 3rd generation of AC charging station. Failure to apply the fix or mitigations provided below may risk buffer overflow attack, which could result in Denial-of-Service.
auch bekannt als (4)
Weitere Namen und Kennungen dieser Entität.
quellen
Welche Quellen diesen Datensatz belegen und wann.
Referenzen (4)
Externe Belege — Patches, Meldungen, Analysen.
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-01.pdfcnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2024-11425cnnvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-01.pdfenisa_euvd
- https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2025-014-01&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2025-014-01.pdfnvd
Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan