IM
IronMonkey Threat Research
‹ Back to ICS Advisories

SEVD-2024-191-02 — EcoStruxure TM Foxboro DCS Core Control Services

HIGH
CVSS 7.8
Date 2026-10-16T20:34:26+00:00
Source schneider-electric
Published by Schneider Electric

// Description

# Schneider Electric Security Notification 09-Jul-24 Document Reference Number – SEVD-2024-191-02 Page 1 of 4 ## EcoStruxure TM Foxboro DCS Core Control Services 9 July 2024 ## Overview Schneider Electric is aware of multiple vulnerabilities in its EcoStruxure TM Foxboro DCS product. The EcoStruxure TM Foxboro DCS product is an innovative family of fault-tolerant, highly available control components, which consolidates critical information and elevates staff capabilities to ensure flawless, continuous plant operation. Failure to apply the remediations provided below may risk local attacks from an authenticated user on the workstation running Foxboro DCS Core Control Services, which could result in loss of system functionality or unauthorized access to system functions. ## Affected Products and Versions Product Version EcoStruxure TM Foxboro DCS Core Control Services Versions 9.8 and prior ## Vulnerability Details CVE ID: CVE-2024-5679 CVSS v3.1 Base Score 7.1 | High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. CVE ID: CVE-2024-5680 CVSS v3.1 Base Score 7.1 | High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denial-of-service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver. CVE ID: CVE-2024-5681 CVSS v3.1 Base Score 7.8 | High | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

// Vulnerabilities (3)

CVE ID CVSS Score Severity Description
CVE-2024-5679 7.8 critical
CVE-2024-5679. CWE-787: Out-of-Bounds Write vulnerability exists that could cause local denial-of-service, or kernel memory leak when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.
CVE-2024-5681 7.8 critical
CVE-2024-5681. CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.
CVE-2024-5680 7.8 critical
CVE-2024-5680. CWE-129: Improper Validation of Array Index vulnerability exists that could cause local denialof- service when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver.

// Affected Products (1)

Vendor Product Asset Type Purdue Level Firmware
Schneider Electric Schneider Electric EcoStruxureTM Foxboro DCS Core Control Services dcs
L2
--

// Remediations (2)

Patch: Patch HF97872598 available for v9.5 to v9.8 of EcoStruxureTM Foxboro DCS Core Control Services incl
Patch HF97872598 available for v9.5 to v9.8 of EcoStruxureTM Foxboro DCS Core Control Services includes a fix for these vulnerabilities. Please contact your local Service Representative or Schneider Electric Process Automation Global Customer Support Center for information on how to download and install this fix:
Mitigation: As the identified vulnerabilities require local user account access, EcoStruxureTM Foxboro DCS work
As the identified vulnerabilities require local user account access, EcoStruxureTM Foxboro DCS workstations should be installed in a secure location to prevent physical access by unauthorized personnel, and appropriate password protections put in place to prevent remote access by unauthorized personnel. To ensure you are informed of all updates, including details on affected products and remediation plans, subscribe to Schneider Electric’s security notification service here: https://www.se.com/en/work/support/cybersecurity/securitynotifications. jsp

// References