CVE-2024-8936

mediumPriorität · verfolgen · 0EPSS 0.005 · 43. PerzentilEURUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.50% (43rd) EPSS
CVSS 6.5 · medium
Is it mine?
6 products
Prüfe deine Angriffsfläche
Who says so?
4 sources
cnnvd · enisa_euvd · fstec_bdu · cisa_csaf_ot

EPSS · bewertet 2026-10-27

CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call used to tamper with memory.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Ein Hersteller-Fix ist verfügbar.

  • BehobenModicon M340 CPU Firmware Versions prior to SV3.65 installed on Modicon M340 CPU Controller (part numbers BMXP34*)cisa_csaf_ot

    Version SV3.65 of Modicon M340 firmware includes a fix for these vulnerabilities and is available for download here: https://www.se.com/ww/en/product-range/1468- modicon-m340

    https://www.se.com/ww/en/product-range/1468-modicon-m340
  • MitigationModicon M340 CPU Firmware Versions prior to SV3.65 installed on Modicon M340 CPU Controller (part numbers BMXP34*)cisa_csaf_ot

    If customers choose not to apply the remediation provided above, they should immediately apply the following mitigations to reduce the risk of exploit: • Setup network segmentation and implement a firewall to block all unauthorized access to port 502/TCP • Configure the Access Control List following the recommendations of the user manuals: “Modicon M340 for Ethernet Communications Modules and Processors User Manual” chapter “Messaging Configuration Parameters”: https://www.se.com/ww/en/download/document/31007131K01000/ • Consider use of external firewall devices such as EAGLE40-07 from Belden to establish VPN connections. For more details refer to “Modicon Controller Systems Cybersecurity, User Guide”: https://www.se.com/ww/en/download/document/EIO0000001999/ • Ensure the M340 CPU is running with the memory protection activated by configuring the input bit to a physical input, for more details refer to the following guideline “Modicon Controller Systems Cybersecurity, User Guide” chapter “Controler Memory Protection”: https://www.se.com/ww/en/download/document/EIO0000001999/

    https://www.se.com/ww/en/download/document/31007131K01000/
02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

8.3
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–high · 4.8–8.3

v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · CISA US
v3.16.5mediumAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · FSTEC (BDU) RU
v3.16.5mediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:Nsecondary · cybersecurity@se.comAusnutzbarkeit 2.2 · Auswirkung 4.2
v4.08.3highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:Nsecondary · ENISA EU
v4.08.3highCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · cybersecurity@se.com
v4.04.8mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)
03

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Trackcoordinatorcisa_ssvcUS
04

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-20USCWE-20USCWE-20US
05

betroffene Produkte (6)

Betroffene Produkte und Versionsbereiche.

06

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-24-326-04Schneider Electric Modicon M340, MC80, and Momentum Unity M1E (Update B)2024-11-12icsa · cisa_csaf_otUS

    Schneider Electric is aware of multiple vulnerabilities in its Modicon Controllers M340 / Momentum / MC80 products.Modicon PAC control and monitor industrial operations.Failure to apply the provided remediations/mitigations below may risk unauthorized access to the controller, which could result in the possibility of denial of service and loss of confidentiality, integrity of the controller.January 2026 Update: Remediation is now available for Modicon MC80.

07

auch bekannt als (4)

Weitere Namen und Kennungen dieser Entität.

08

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdfstec_bducisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2024-11-13geändert 2026-06-17
09

Referenzen (4)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan