1. Home
  2. CVE Database
  3. CVE-2024-37038
HIGH · 7.5

CVE-2024-37038

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when craf...

Vulnerability Description

CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH

Affected Products

VendorProductVersions
Schneider-ElectricSage Rtu Firmware< c3414-500-s02k5_p9
Schneider-ElectricSage 1410-
Schneider-ElectricSage 1430-
Schneider-ElectricSage 1450-
Schneider-ElectricSage 2400-
Schneider-ElectricSage 3030 Magnum-
Schneider-ElectricSage 4400-

Related Weaknesses (CWE)

CWE-276

References

FAQ

What is CVE-2024-37038?

CVE-2024-37038 is a vulnerability with a CVSS score of 7.5 (HIGH). CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when craf...

How severe is CVE-2024-37038?

CVE-2024-37038 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-37038?

Check the references section above for vendor advisories and patch information. Affected products include: Schneider-Electric Sage Rtu Firmware, Schneider-Electric Sage 1410, Schneider-Electric Sage 1430, Schneider-Electric Sage 1450, Schneider-Electric Sage 2400.