CWE-276: Incorrect Default Permissions vulnerability exists that could allow an authenticated user with access to the device’s web interface to perform unauthorized file and firmware uploads when crafting custom web requests.
CWE-276: Existe una vulnerabilidad de permisos predeterminados incorrectos que podría permitir que un usuario autenticado con acceso a la interfaz web del dispositivo realice cargas de archivos y firmware no autorizadas al crear solicitudes web personalizadas.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | HIGH |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Secondary |
en
CWE-276
|
| [email protected] | Primary |
en
CWE-276
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| schneider-electric | sage_rtu_firmware | * | <built-in method update of dict object at 0x7e60a8897800> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:schneider-electric:sage_rtu_firmware:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| No | cpe:2.3:h:schneider-electric:sage_1410:-:*:*:*:*:*:*:* |
| No | cpe:2.3:h:schneider-electric:sage_1430:-:*:*:*:*:*:*:* |
| No | cpe:2.3:h:schneider-electric:sage_1450:-:*:*:*:*:*:*:* |
| No | cpe:2.3:h:schneider-electric:sage_2400:-:*:*:*:*:*:*:* |
| No | cpe:2.3:h:schneider-electric:sage_3030_magnum:-:*:*:*:*:*:*:* |
| No | cpe:2.3:h:schneider-electric:sage_4400:-:*:*:*:*:*:*:* |