CVE-2024-9409 HIGH

Published: 2024-11-13 | Last Modified: 2024-11-19 | Status: Analyzed

Description

CWE-400: An Uncontrolled Resource Consumption vulnerability exists that could cause the device to become unresponsive resulting in communication loss when a large amount of IGMP packets is present in the network.

Additional Descriptions (1)

CWE-400: Existe una vulnerabilidad de consumo descontrolado de recursos que podría provocar que el dispositivo deje de responder y produzca pérdida de comunicación cuando hay una gran cantidad de paquetes IGMP en la red.

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector	NETWORK
Attack Complexity	LOW
Privileges Required	NONE
User Interaction	NONE
Scope	UNCHANGED
Confidentiality Impact	NONE
Integrity Impact	NONE
Availability Impact	HIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 8.7 (HIGH)

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector	NETWORK
Attack Complexity	LOW
Attack Requirements	NONE
Privileges Required	NONE
User Interaction	NONE
Vulnerability Confidentiality	NONE
Vulnerability Integrity	NONE
Vulnerability Availability	HIGH
Subsequent Confidentiality	NONE
Subsequent Integrity	NONE
Subsequent Availability	NONE

Source: [email protected]

Type: Secondary

Weaknesses

Source	Type	Description
[email protected]	Secondary	en CWE-400

Affected Products

Vendor	Product	Version	Update	Type
schneider-electric	powerlogic_pm5341_firmware	*	<built-in method update of dict object at 0x7e60a8a61a00>	Operating System
schneider-electric	powerlogic_pm5340_firmware	*	<built-in method update of dict object at 0x7e60a8a63ec0>	Operating System
schneider-electric	powerlogic_pm5320_firmware	*	<built-in method update of dict object at 0x7e613cf23f40>	Operating System

Affected Configurations

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm5341_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm5341:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm5340_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm5340:-:::::::*`

Operator: OR

Vulnerable	CPE
Yes	`cpe:2.3:o:schneider-electric:powerlogic_pm5320_firmware::::::::`

Operator: OR

Vulnerable	CPE
No	`cpe:2.3:h:schneider-electric:powerlogic_pm5320:-:::::::*`

References

https://download.schneider-electric.com/doc/SEVD-2024-317-01/SEVD-2024-317-01.pdf
Source: [email protected]

Mitigation Patch Vendor Advisory