CVE-2024-5056

mediumPriorität · verfolgen · 26EPSS 0.004 · 29. PerzentilEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.35% (29th) EPSS
CVSS 6.5 · medium
Is it mine?
18 products
Prüfe deine Angriffsfläche
Who says so?
5 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

CWE-552: Files or Directories Accessible to External Parties vulnerability exists which may prevent user to update the device firmware and prevent proper behavior of the webserver when specific files or directories are removed from the filesystem.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenModbus/TCP Ethernet Modicon M340 FactoryCast modulecisa_csaf_ot

    Version SV6.80 of BMXNOE0110 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0110/ethernet-tcp-ip-network-module-modicon-m340-automation-platform-flash-memory-card-internal-ram-16-mb-1-x-rj45-10-100/

    https://www.se.com/ww/en/product/BMXNOE0110/ethernet-tcp-ip-network-module-modicon-m340-automation-platform-flash-memory-card-internal-ram-16-mb-1-x-rj45-10-100/
  • BehobenModbus/TCP Ethernet Modicon M340 modulecisa_csaf_ot

    Version SV3.60 of BMXNOE0100 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product/BMXNOE0100/network-module-modicon-m340-modbus-tcp-1-x-rj45-flash-memory-card

    https://www.se.com/ww/en/product/BMXNOE0100/network-module-modicon-m340-modbus-tcp-1-x-rj45-flash-memory-card/
  • BehobenModicon M340 Firmware versions prior to SV3.70 installed on Modicon Controller M340cisa_csaf_ot

    Version SV3.70 of Modicon M340 includes a fix for this vulnerability and is available for download here: https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware

    https://www.se.com/ww/en/product-range/1468-modicon-m340/#software-and-firmware
  • MitigationModbus/TCP Ethernet Modicon M340 FactoryCast modulecisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the devices. • FTP service is disabled by default. Deactivate the FTP service after use when not needed. • Configure the Access Control List following the recommendations of the user manuals: o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31 007131K01000/

    https://www.se.com/ww/en/download/document/31007131K01000/
  • MitigationModbus/TCP Ethernet Modicon M340 modulecisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the devices. • FTP service is disabled by default. Deactivate the FTP service after use when not needed. • Configure the Access Control List following the recommendations of the user manuals: o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31 007131K01000/

    https://www.se.com/ww/en/download/document/31007131K01000/
  • MitigationModicon M340 Firmware versions prior to SV3.70 installed on Modicon Controller M340cisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to FTP port 21/TCP on the devices. • FTP service is disabled by default. Deactivate the FTP service after use when not needed. • Configure the Access Control List following the recommendations of the user manuals: o “Modicon M340 for Ethernet Communications Modules and Processors User Manual” in chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31 007131K01000/

    https://www.se.com/ww/en/download/document/31007131K01000/
02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

6.5
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 2.5
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · CISA US
v3.16.5mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · ENISA EU
v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Lsecondary · cybersecurity@se.comAusnutzbarkeit 3.9 · Auswirkung 2.5
v3.16mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-552USCWE-552USCWE-552US
05

betroffene Produkte (18)

Betroffene Produkte und Versionsbereiche.

06

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-25-254-09Schneider Electric Modicon M340, BMXNOE0100, and BMXNOE0110 (Update A)2024-06-11icsa · cisa_csaf_otUS

    Schneider Electric is aware of a vulnerability in its Modicon M340 and BMXNOE0100 and BMXNOE0110 products. The Modicon M340 is a programmable automation controller; BMXNOE0100 and BMXNOE0110 are network modules used with Modicon M340. Failure to apply the mitigations provided below may prevent user to update the device firmware and prevent proper behavior of the webserver. The BMXNOE and Modicon M340 operations are not impacted by this vulnerability. August Update: Remediations are available for BMXNOE0100 (Modbus/TCP Ethernet Modicon M340 module) and BMXNOE0110 (Modbus/TCP Ethernet Modicon M340 FactoryCast module)

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otnvdNVDCVE.orgMITRE
veröffentlicht 2024-06-12geändert 2026-06-17
09

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan