7.7
Élevée
CVE-2024-8935 CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of…
Description
CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause a denial of service and loss of confidentiality and integrity of controllers when conducting a Man-In-The-Middle attack between the controller and the engineering workstation while a valid user is establishing a communication session. This vulnerability is inherent to Diffie Hellman algorithm which does not protect against Man-In-The-Middle attacks.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Modicon M340 CPU (part numbers BMXP34*) | Versions non publiées | |
| Modicon MC80 (part numbers BMKC80) | Versions non publiées | |
| Modicon Momentum Unity M1E Processor (171CBU*) | Versions non publiées | |
| modicon_m340_bmxp341000 | Versions non publiées | |
| modicon_mc80_bmkc8020301 | Versions non publiées | |
| modicon_momentum_unity_m1e_processor | Versions non publiées |
Autres CVE de Modicon M340 CPU (part numbers BMXP34*)
Les 12 CVE de Modicon M340 CPU (part numbers BMXP34*) →
CVE-2024-8936
CWE-20: Improper Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory…
8.3
Élevée
CVE-2024-8938
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a…
9.2
Critique
CVE-2024-8937
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a…
8.3
Élevée
CVE-2024-8933
CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists…
7.5
Élevée